Welcome to Midasbuy!

This Privacy Policy explains the when, how and why when it comes to the processing of your personal information in connection with the Midasbuy service, which supports payment transactions (the “Service”) and is available on the Midasbuy Website and App, and sets out your choices and rights in relation to that information. Please read it carefully – it will allow you to understand how we collect and use your information, and how you can control it.

Please note that this Privacy Policy only applies to the Service. If you use any other products or services (including any mini-game available or hosted on our Website) please refer to the privacy policy for that particular product or service. For clarity, we do not operate the mini games or process any in-game data generated in connection with your use of the mini-games on our Website.

If you do not agree to the processing of your personal information in the way this Privacy Policy describes, please do not provide your information when requested and stop using the Service. By using the Service you are acknowledging how we process your personal information as described in this Privacy Policy.

For the purpose of data protection laws, the data controller of your personal information in relation to the Service is High Morale Developments Limited. The registered address of High Morale Developments Limited is 29 Floor, Three Pacific Place, 1 Queen’s Road East Wanchai, Hong Kong.

If you have any questions about anything in this Privacy Policy, or want to exercise any rights you may have, our contact information can be found here. You can also reach out to our data protection officer here. We have representatives for data protection purposes listed here.

1. Cookies

We use cookies and other similar technologies (“Cookies”) to enhance your experience using the Service on our Website. Cookies are small files which, when placed on your device, enable us to provide certain features and functionalities.

For more information about our Cookies policy, click here.

2. Children

Children must not use the Service for any purpose. By children, we mean users under the age of 18 years old; or in the case of a region where the minimum age for processing personal information differs, such different age.

We do not knowingly collect personal information from children under these ages for any purpose. If you believe that we have personal information of a child under these ages, please contact us.

3. How We Process Your Personal Information

This section provides more detail on the types of personal information we collect from you, and why.

For users who live in Brazil, the European Economic Area, Indonesia, Switzerland, Thailand, Türkiye or the United Kingdom, it also identifies the legal basis under which we process your data.

Personal Information	Use	Legal Basis (where applicable)
Guest users (to the extent this function is available in your region)
Guest User Information (for guests that do not provide a player ID and browse the website): IP address.	We use this information to determine your location.	It is in our legitimate interest to collect this information to allow you to connect to the Website.
Guest User Information (for guests that provide a player ID and browse the Website): game nickname and game open ID, and device information such as web browser and browser version, location of device, IP address, open ID, cookie information, operating system version, country, internet connection, page loading time, type of mobile or computing device, number of visits, time using the Midasbuy platform, networks, demographic estimates, flow-through the Midasbuy platform or referral source, and device fingerprint data.	We use this information to allow you to use the Midasbuy platform, to confirm and verify your player ID, and to conduct data analytics.	For browser version, operating system version, country, internet connection, page loading time, type of mobile or computing device, number of visits, time using the Midasbuy platform, networks, flow-through the Midasbuy platform or referral source: It is in our legitimate interest to process this information for data analytics purposes and to understand how you use the Midasbuy platform to optimize our platform. For other data: Necessary to perform our contract with you to process your payment and provide the Service.
Information you provide to us (either directly or through a third party)
User Information: date of birth (not stored), name, username, email address and Facebook nickname and profile picture. If you connect to the Service through a Game Operator or Third Party Website, then we will also collect the details provided by that third party such as the referring website. If you enable the passwordless authentication feature, we will also collect randomly generated credential ID and public key in relation to your User ID.	We use this information to create your Midasbuy account and facilitate your purchase in Midasbuy in accordance with your request.	Necessary to perform our contract with you to provide the Service.
Transaction Data: bank, invoice information such as billing address, email address, credit card type, phone number, account holder information e.g. account name, user name, Midasbuy registration date, number of successful orders in past three months, whether the card number was manually inputted and pasted, game ID, login method, IP address, device fingerprint (which includes information like time zone, browser information, CPU class, platform you used i.e. iOS, android or web), card details and shipping information, your payment information provided to us by third party payment processors (purchase payment date, merchant transaction ID).	We use this information to detect fraudulent activity and verify transactions.	It is in our legitimate interest to ensure the integrity of the Service and that your details are not being used fraudulently.
Customer Support Information: The email address you use for communications as well as any other personal information you choose to include in your email to us. MUID and Game Open ID for Midasbuy VIP users	We use this information to facilitate our handling of your customer support request.	It is necessary for us to use this information to perform our contract with you to provide the Service.
Feedback Information: Picture(s) you provide to us or take (if you’ve enabled camera-permission) when using the App.	We use this information to address your feedback regarding the Service.	It is necessary for us to use this information to perform our contract with you to provide the Service.
Sweepstakes Participation Information: name, country, player ID, email address, phone number, payment method.	If you participate in a sweepstakes event, we use this information to send you your prize and provide you with a rebate or top-up if you win.	We collect this information with your consent.
Livestreaming interaction information: When you participate in our livestreams by sending bullet screen messages, comments, or questions, we will collect and process the following information: Your user ID (if you are watching the livestream on a third-party platform such as YouTube); Your Midasbuy User ID (if you are watching the livestream on our Website); The nickname you have designated for the livestream. Additionally, we will process the content of any bullet screen messages, comments, or questions you submit during the livestream.	We use this information to quickly respond to your questions and comments during the livestream by comparing your submissions against our predefined Q&A database. After the livestream concludes, we analyze the collected data to assess the effectiveness of the session and improve our services for future events.	It is necessary for us to use this information to perform our contract with you to respond to your questions and comments during the livestream. It is in our legitimate interest to improve our services after the livestream concludes.
Marketing emails: email address.	We use this information to send you news, special offers and discounts about our and our partners’ and affiliates’ goods and services which may be of interest to you.	We collect this information with your consent.
Website notifications: user ID.	We use this information to provide Website notifications about news, special offers and discounts about our and our partners’ and affiliates’ goods and services.	We process this information with your consent.
Payment information (native or from payment processor) such as card number, CVV, expiry date, card holder's name, user's billing address; transaction cost, time and date; payer ID/Open ID; Order reference ID Notification of payment status (from payment processor): country, payment status, device type, currency, funding source, phone number, email address, card hash, card name and details, card issuing bank, billing address, expiry date, amount, date, time, payment method, browser code, payment account reference, authentication code, card bin Notification of subscription, refund, payment and/or transaction status (to merchants): subscription ID, order ID, status of order, product ID, amount, currency, payer ID, subscription start time, subscription end time, merchant details, subscription status, subscription execution phase, refund information For recurring subscription payment management purposes: Payment method, merchant user ID, subscription ID, product ID, payer ID, subscription cycles, subscription plan (amount, currency, period, status), subscription executed counts For tax purposes: country, province, zipcode, IP address	We use this information to process your transaction, ensure the validity of your identity and transaction, and manage your recurring subscription payments. We also use this information for tax purposes.	We process this information pursuant to our contract with you to process transactions.
Card binding function data (if and to the extent applicable) & Card binding data (recurrent payments): card number (encrypted), expiry date, card holder's name, user’s billing address, CVV (not stored after verification), muid (the user ID to MidasBuy), openid (the player ID to the game), portal serial No (the tracking number for the payment).	We use this information: · To provide a card binding function for the Midasbuy platform; · To provide card binding function to facilitate recurring payments in the Midas buy platform	We process this information pursuant to our contract with you to process transactions. We process this information with your consent.
Social Connect Information (if you choose to log in via your social media account with these networks): Via Facebook: user email, user token, name, profile picture Via Google: user email, user token, name, profile picture Via Discord: username, user token Via Level Infinite Pass: user token, openID, email address https://account.levelinfinite.com/privacypolicy.html	We use this information to create your account for the Service in accordance with your request.	We process this information with your consent.
TrustPilot Information: name, email address, country, reference ID (order ID, invoice number), access token	We use this information to trigger a Trustpilot platform service review invitation for Midasbuy users	We process this information with your consent.
Information about you generated as part of the Service
Account Information: user ID.	We generate a unique user ID when you create a Midasbuy account.	Necessary to perform our contract with you to provide the Service.
Browser and Device Information: details of your browser version, operating system version, country, RFID tag, IP address, open ID, internet connection, page loading time, type of mobile or computing device, date and time stamps of actions, number of visits, time using the Midasbuy platform, networks, flow through the Midasbuy platform or referral source, and player ID.	We use this information to facilitate your purchase in Midasbuy in accordance with your request.	It is necessary for us to use this information to perform our contract with you to provide the Service.
In-game status information: If you have made a purchase using our Service, a Yes or No confirmation of whether you are active in-game in the country in which your online payment account is from.	We use this information to detect fraudulent activity and verify transactions.	It is in our legitimate interest to ensure the integrity of the Service and that your details are not being used fraudulently.
Mobile device fingerprint data (a digital signature that does not collect any biometric data): your device fingerprint, time of creation, time zone, device OS information and browser type, platform information, QQ login state, node, screen size and font, audio fingerprint, battery status, domain, adblock.	We use this information for fraud verification purposes.	It is in our legitimate interest to ensure the integrity of the Service and that your details are not being used fraudulently.
Device information: UUID, GUID, device model, device brand, device manufacturer, device SDK version, android version, device default country, device default language, device time zone, carrier name.	We use this information for performing security and risk management for the App, version updates, and performance monitoring and optimization for the App.	It is in our legitimate interest to maintain and improve the security and integrity of the Service and to improve the App.
Version update information: device model, android version, manufacturer, deviceSDK version, CPU, patch information.	We use this information for performing version updates to the App.	Necessary to perform our contract with you to provide the Service.
Risk Control Information: order id, transaction amount, transaction status, user ID, email address, device information, midas id, IP address, phone number, card number (MD5 irreversibly encrypted), time, country, refunds history, refunds amount, successful transaction history, transaction interception information, days, order timings, order amounts, order days, user profile	We use this information, and aggregated user profiles derived from such information, to process your transaction, improve the Service, prevent fraud and misuse of the Service, and for risk control purposes.	It is in our legitimate interest to maintain and improve the security and integrity of the Service.
Request log information: URL, user agent, referrer, IP address, request method (get or post), request protocol (http/1.1 or http/2), status code, exception stage, reason for exception.	We use this information to monitor the network quality and to manage any network crashes that arise.	Necessary to perform our contract with you to provide the Service.
Information relating to any purchases you make on the Midasbuy platform
Purchase Information: items purchased and their cost, the time, date and currency of the purchase, order ID, open ID, player ID, country, game account balance and purchase history. If you pay with paytm, we will collect your email address. If you pay with tpay, we collect your telephone number. If you pay with your bank card, we will collect the card number, the expiry date, the card holder's name and the billing address.	We use this information to facilitate your purchase in Midasbuy in accordance with your request and provide access to your transaction history.	It is necessary for us to use this information to perform our contract with you to provide the Service.
Information relating to any advertisement attribution about you on the Midasbuy platform
Advertising attribution information: cookie id; user browsing/click interactions, and transaction payment amounts for advertising attribution.	We use this information to measure the effectiveness of advertisement about us and improve our services.	We process this information with your consent.
Performance information (Firebase): advertising id, app instance id, device model, deviceSDK version, device brand, device country, device language and device timezone.	We use this information for the App’s performance and monitoring and optimization.	It is in our legitimate interest to optimize and improve the Service and to allow us to monitor the effectiveness of our advertisements.

4. Ho w We Store and Share Your Personal Information

Pursuant to our contract with you, we may transfer data outside of the location in which you are based for the purposes described in this Privacy Policy.

We have servers for the Service in Singapore. The servers applicable to your use of the Service will depend upon your location. We also have support, engineering and other teams who may support the Service in Singapore and China.

For EEA/UK users, transfers between our affiliates and to third parties use applicable safeguards, such as incorporating standard contractual clauses, obtaining your consent first or taking into account adequacy assessments.

Only where necessary will we share your personal information with third parties. Situations where this occur are:

· Third parties that provide services in support of the Service, including providers of cloud services that process information identified in this policy on their servers for the purpose of providing the Service, payment service providers which provide payment aggregation services (eg. Harvest Sharp Limited), service providers used to identify fraudulent or suspicious transactions (e.g. Cybersource International Inc., Boku Payments), third party payment processors which ensure you can complete your transaction, (e.g. Adyen N.V.) or conduct data analysis (e.g. Centauri Dynamic Pte. Ltd.), third party consumer review platform (eg. Trustpilot A/S), or third party ad partners (e.g. Google LLC/Firebase). All companies providing services for us are prohibited from retaining, using, or disclosing your personal information for any purpose other than providing us with their services and/or to comply with their legal obligations under applicable laws.

· Merchants. We also share your personal information with merchants from whom you purchase products and services, for the purpose of notifying merchants of your payment, transaction, refund and/or subscription, enabling merchants to proceed with order fulfilment for the purchases or subscriptions you made.

· Companies within our corporate group who process your personal information solely for the purpose of providing the Service to you (eg. Proxima Beta Pte. Ltd. for the creation of social media accounts in accordance with your request). All such group companies may only use your personal information in accordance with this Privacy Policy.

Regulators, judicial authorities and law enforcement agencies. There are circumstances in which we may be legally required to disclose information about you, such as to comply with legal obligations or processes. In complying with the terms of valid legal processes, such as a subpoena, or search warrant, unfortunately we may not be able to seek your consent to or notify you in advance of such disclosure.
Third parties to ensure safety, security, or compliance with laws. We may disclose your information to:

enforce our terms and conditions and other agreements, including investigation of any potential violation thereof;
detect, prevent or otherwise address security, fraud or technical issues; or
protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (such as exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).

A third party that acquires all or substantially all of us or our business. We may also disclose your information to third parties if we either: (a) sell, transfer, merge, consolidate or re-organise any part(s) of our business, or merge with, acquire or form a joint venture with, any other business, in which case we may disclose your data to any prospective buyer, new owner, or other third party involved in such change to our business; or (b) sell or transfer any of our assets, in which case the information we hold about you may be sold as part of those assets and may be transferred to any prospective buyer, new owner, or other third party involved in such sale or transfer.

Third-party advertisers. Third-party advertisers may use cookies to collect your information to help them reach audiences that may be interested in our campaigns, to detect fraudulent traffic, and to measure the effectiveness of the ads they serve. These cookies are only set with your consent. For more information about our Cookies policy, click here.

5. The Security of Your Personal Information

We have information security and access policies that limit access to our systems and technology, and we protect data through the use of technological protection measures such as encryption.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will implement and maintain reasonable measures to protect your personal information, we cannot guarantee the security of the information transmitted through the Service or otherwise via the Internet; any transmission is at your own risk.

6. Data Retention

We do not keep your data for longer than is necessary to fulfil the relevant purpose described above unless we are required or permitted to do so under law. If we retain your information beyond the retention periods set out below, for example to comply with applicable laws, we will store it separately from other types of personal information.

For further details on how long we keep your data, please refer to the time periods set out below.

Personal Information	Retention Policy
Guest User Information (for guests that do not provide a player ID and browse the Website): IP address	1 year
Guest User Information (for guests that provide a player ID and browse the Website)	7 days
Request log information	60 days
User Information (other than date of birth which we do not store), Browser and Device Information, In-game status information, Purchase Information, Support Information, Transaction Data, Account Information, Payment Information, Device Information, Feedback Information, Performance Information (Firebase)	We generally store this data for the lifetime of your use of the Service (i.e. until account deletion in accordance with your request) and then delete it within 30 days. However, we retain transaction data (which includes your name and user ID as well as bank details) for 160 days from the date of the last transaction involving the credit card. We do this even where you request that we delete your account because this is in line with our legal obligations and is also necessary to ensure that we can perform our contract with you. Where you do not request account deletion, the data will be retained for one year after each applicable Game is closed, before it is deleted.
(if you enable the passwordless feature) Credential ID and public key	Stored for the validity of the passwordless feature and then deleted if you disable the feature.
Sweepstakes Participation Information	Stored for the duration of the sweepstakes event and then deleted within 10 days.
Marketing emails and website notifications	Stored for the lifetime of your use of the Service (i.e. until account deletion in accordance with your request) and/or when you choose to unsubscribe from receiving marketing emails or adjust your Website notification settings, whichever is earlier.
Device Fingerprint Data	Retained for up to one week after collection for verification purposes and deleted thereafter.
Account Registration Information Facebook Log-In Information Google Log-In Information Discord Log-In Information Level Infinite Account Log-In Information Customer Support Information MUID Game Open ID	Stored for the lifetime of your use of the Service and then deleted within 30 days after the end of the Service, or deleted manually within 30 days of your request, whichever is earlier.
Risk Control Information	Stored for the lifetime of your use of the Service (i.e. until account deletion in accordance with your request), or for the minimum period to meet any regulatory obligations, and then to be deleted within 30 days. User profiles will be stored for 1 year and then deleted thereafter.
Card binding data (recurrent payment)	Stored for the lifetime of your use of the Service and then deleted within 30 days after the end of the Service, or deleted manually within 30 days of your request, whichever is earlier.
TrustPilot Information	Stored for the lifetime of your use of the Service and then deleted within 30 days after the end of the Service, or deleted manually within 30 days of your request, whichever is earlier.
Livestreaming interaction information	Stored for 30 days after one livestream concludes.
Advertising attribution information	1 year. Typically valid for 365 days, after which browsers automatically clear them. You may also manually delete cookies via browser settings.

7. Yo ur Rights

Some jurisdictions’ laws grant specific rights to users of the Service. Please refer to the Supplemental Jurisdiction-Specific Terms, or the applicable laws in your jurisdiction, for an overview of specific rights that apply to persons subject to data protection laws in the listed jurisdictions and how these can be exercised.

You may have certain rights in relation to the personal information we hold about you. Some of these only apply in certain circumstances (as set out in more detail below). You can exercise some of these rights directly by accessing and updating the information in your account. If you believe we hold any other personal information about you, please contact us.

Access

You may have the right to access personal information we hold about you, how we use it, and who we share it with. You can access the personal information you have made available as part of your account by logging into your account.

Portability

You may have the right to receive a copy of certain personal information we process about you. For example, in certain jurisdictions this can comprise personal information we process on the basis of your consent (e.g., survey information) or pursuant to our contract with you (e.g., account name), as described above in the section “How We Use Your Personal Information”. We will provide further information to you about transferring this data if you make such a request.

Correction

You may have the right to correct personal information we hold that is inaccurate. You can access the personal information we hold about you by logging into your Service account

Erasure

You may be able to delete your account, or remove certain personal information, by contacting us here. We may need to retain personal information if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or freedom of expression) but we will let you know if that is the case. Where you have requested that we erase personal information that has been made available publicly on the Service and there are grounds for erasure, we will use reasonable steps to try to tell others that are displaying the personal information or providing links to the personal information to erase it too.

Restriction of Processing to Storage Only

You may have a right to require that we stop processing the personal information we hold about you (other than for storage purposes in certain circumstances). Please note, however, that if we stop processing the personal information, we may use it again if there are valid grounds under data protection laws for us to do so (for example, for the defence of legal claims or for another’s protection). Where we agree to stop processing the personal information, we will take steps to tell any third party to whom we have disclosed the relevant personal information so that they can stop processing it too.

Objection

You may have the right to object to our processing of your personal information. If you wish to do so, please contact us here, and we will consider your request.

Consent Withdrawal

To the extent provided by applicable laws and regulations, you may withdraw consent you previously provided to us for certain processing activities by contacting us here. Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent we may not be able to deliver the expected service. Please note that the right to withdraw consent is only available if the legal basis for processing information is consent.

Announcements

We may from time to time send you announcements when we consider it necessary to do so (for example, when we temporarily suspend access to the Service for maintenance, or security, privacy or administrative-related communications). These are essential system and service-related announcements and you are not able to opt-out of these notifications, which are not promotional in nature.

Advertising

You may choose to stop receiving personalised advertising or marketing promotions from us when using the Service by clicking here: https://www.midasbuy.com/email-unsubscribe, by following the opt-out instructions included in the Settings section of the Service or by contacting us here.

8. Contact

You can reach us using our online form here to submit Data Subject Rights requests (“DSR”) and any questions or concerns related to data privacy. This DSR Form also allows you to contact our Data Protection Officer regarding your privacy-related inquiries.

If you are an agent or official of a regulatory authority and have a specific data and privacy regulatory inquiry, please use our Data and Privacy Regulatory Inquiry Form here.

We will make every effort to address your request as quickly as possible. This does not affect your right to file a complaint with a data protection authority in your region if you believe we have violated data protection laws.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S. based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request .

9. Changes

If we make any changes to this Privacy Policy we will post the updated Privacy Policy here and notify you in accordance with relevant legal requirements.

10. Language

Except as otherwise prescribed by law, in the event of any discrepancy or inconsistency between the English version and local language version of this Privacy Policy, the English version shall prevail.

Our Representatives in Certain Jurisdictions

Region	Representative	Address	Contact details
EU	Tencent International Service Europe B.V.	Buitenveldertselaan 1-5, 1082 VA, Amsterdam, the Netherlands	Online Form here
Korea	Tencent Korea Yuhan Hoesa	152, Taeheran-ro, Gangnam-gu (Gangnam Finance Center, Yeoksam-dong), Seoul, Korea	Online Form here
Turkey	Özdağıstanli Ekici Avukatlık Ortaklığı.	Varyap Meridian Grand Tower ABlok Al Zambak Sok No: 2 K: 32 D. 270 Ataşehir Istanbul Turkey	tencent@iptech-legal.com

SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

Some jurisdictions’ laws contain additional terms for users of the Service, which are set out in this section.

If you are a user located in one of the jurisdictions below, the terms set out below under the name of your jurisdiction apply to you in addition to the terms set out in our Privacy Policy above.

Algeria

By using the Service, you give your consent to the collection, storage, treatment and use of your personal information, and transfer of your personal information to third parties or our affiliates to help us deliver the Service, in each case location in the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

Argentina

If you are dissatisfied with our response to your request for access to, correction, or erasure of your personal information or your privacy complaint in respect of your personal information, you may contact the Agency for Access to Public Information at: Av. Pte. Gral. Julio A. Roca 710, Piso 2°, Ciudad de Buenos Aires (Telephone: +5411 3988-3968 or email: datospersonales@aaip.gob.ar). While we take reasonable steps to ensure that third party recipients of your personal information comply with privacy laws that are similar to those of your jurisdiction, by providing your personal information and by using the Service, you consent to the transfer of your personal information to a jurisdiction where privacy laws may not offer the same level of protection as the laws that may apply in Argentina.

Australia

We take reasonable steps to ensure that third party recipients of your personal information located outside Australia handle your personal information in a manner that is consistent with Australian privacy laws. However, you acknowledge that we do not control, or accept liability for, the acts and omissions of these third party recipients. You have the right to access personal information we hold about you, how we use it, and who we share it with. You have the right to correct any of your personal information we hold that is inaccurate.

Where practicable, we will give you the option of not identifying yourself or using a pseudonym when registering an account on or using the Service. You acknowledge that if you do not provide us with your personal information, we may be unable to provide you with access to certain features or sections of the Service, including social media integration and in-Service purchases.

If you are dissatisfied with our response to your request for access to, or correction of, your personal information or your privacy complaint in respect of your personal information, you may contact the Office of the Australian Information Commissioner (Telephone: +61 1300 363 992 or email: enquiries@oaic.gov.au).

Bangladesh

By acknowledging the Privacy Policy, you expressly state that you authorise us to collect, use, store, and process your personal data, including disclosing to third parties, to the extent provided by the Privacy Policy. You also consent to the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

Brazil

Whenever we use your personal information based on your consent, you may revoke the consent that you have previously given for the collection, use and disclosure of your personal information, subject to contractual or legal limitations. To revoke such consent, you may terminate your account or you can contact us as set out in Section 8 (Contact). This may affect our provision of the Service to you.

BY ACCEPTING THIS PRIVACY POLICY, YOU EXPRESSLY STATE THAT YOU AUTHORISE US TO COLLECT, USE, STORE, AND PROCESS YOUR PERSONAL INFORMATION, INCLUDING, DISCLOSING TO THIRD PARTIES, TO THE EXTENT PROVIDED BY THIS PRIVACY POLICY.

California

This section applies to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”) (as amended by the California Privacy Rights Act of 2020) (“CCPA”). For purposes of this section, “personal information” and “sensitive personal information” have the meanings given in the CCPA and do not include information excluded from the CCPA’s scope.

Collection and Disclosure of Personal Information

Over the past 12 months, we have collected and disclosed for a business purpose the following categories of personal information from or about you or your device:

Identifiers, such as your name as it appears on your social media profile, Open ID / user ID, IP address, device ID, device token, phone number, mailing address, email address, and nickname. This information is collected directly from you and your device and from social media platforms if you choose to sign up using a social media account.
Social Connect Information: (i) Facebook – user email, user token (ii) Google - user email, user token (iii) Level Infinite Pass – user token, open id.
Internet or other electronic network activity information, such as your information regarding your use of the Service, date and time stamps of actions, log-in and clickstream data, request log information and other Device Information as described in the main Privacy Policy. This information is collected directly from you and your device.
Commercial information about any transactions within the Service such as what products were purchased and how much they cost. This information is collected directly from you and your device and the Google Play or Apple iOS store.
Geolocation data such as your region location when you set up your profile and choose to provide this information for the Service. This information is collected directly from you.
Audio and visual information such as your social media profile picture, photos shared in the Service, and audio messages. This information is collected directly from you and from social media platforms if you choose to sign up using a social media account.
Mobile device fingerprint data (a digital signature that does not collect any biometric data) such as your device fingerprint, time of creation, time zone, device OS information and browser type, platform information, QQ login state, node, screen size and font, audio fingerprint, battery status, domain, adblock.
Other information described in subdivision (e) of Section 1798.80, including information about your gender, nationality, or age. This information is collected directly from you in the context of being our consumer.

We collect and disclose your personal information for the following purposes:

To provide you with the Service, maintain your account, provide customer service, process payments, and deliver audio and text messages.
To process surveys and administer sweepstakes.
To improve our services, including the functionality of the Service.
For security and verification purposes, including to prevent and detect fraudulent activity.
To address and remediate technical issues and bugs.

For additional information about what each type of personal information is used for, see Section 3 (How We Process Your Personal Information).

We disclose each of the categories of personal information that we collect to the following types of entities:

Other companies within our corporate group who process your personal information in order to operate the Service.
Other companies that provide services on our behalf in support of the Service and who are prohibited by contract from retaining, using, or disclosing personal information for any purpose other than for providing their services to us.
Merchants from whom you purchase the products or services.
Regulators, judicial authorities and law enforcement agencies.
Entities that acquire all or substantially all of our business.

In the past 12 months, we have not sold or shared personal information of California residents within the meaning of “sold” and “Share” in the CCPA. And we have no knowledge of any sale or sharing of personal information of users under 16 years of age.

In addition, we do not use or disclose sensitive personal information for purposes other than to perform the services reasonably expected by an average consumer who requests those services.

Retention of Your Personal Information

The retention period varies among the different categories of data collected. For detailed information about the retention period for any specific category of data, see this chart in the main portion of the Privacy Policy.

Rights under the CCPA:

If you are a California resident and the CCPA does not recognize an exception that applies to you or your personal information, you have the right to:

Request we disclose to you free of charge the following information covering the 12 months preceding your request:

the categories of personal information about you that we collected;
the categories of sources from which the personal information was collected;
the purpose for collecting personal information about you;
the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you; and
the specific pieces of personal information we collected about you;

Request we delete personal information we collected from you, unless CCPA recognises an exception;
Request we correct inaccurate personal information that we maintain about you; and
Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or denying goods or services to you when you exercise your rights under the CCPA.

We aim to fulfil all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

How to Exercise Your Rights

First, you may wish to log into your account and manage your data from there. If you are a California resident to whom the CCPA applies, you may also exercise your rights, if any, regarding other data by contacting us as specified in Section 8 (Contact). We may take steps to verify your identity before complying with your request to protect your privacy and security, and may decline your request if we are unable to verify your identity. To verify your identity, we may need the following information from you: your first name, last name, address, phone number, date of birth and email address.

Under the CCPA, you may exercise these rights yourself or you may also designate an authorized agent to make these requests on your behalf. In order for us to process the request, you must provide the authorized agent with signed written permission. We reserve the request to require the agent to verify their own identity and to confirm directly with you that you have provided the authorized agent permission to submit the request.

Questions

If you have questions or concerns regarding this Privacy Policy, please contact us as set out in Section 8 (Contact).

Canada

If you are located in Canada and wish to obtain written information about our policies and practices with respect to our service providers located outside Canada, you may contact us as specified in Section 8 (Contact). Where we use service providers who might have access to your personal information, we require them to have privacy and security standards that are comparable to ours. We use contracts and other measures with our service providers to maintain the confidentiality and security of your personal information and to prevent it from being used for any purpose other than as provided in this Privacy Policy.

Colombia

Your authorization to process personal information for the Service may be expressed (i) in writing, (ii) orally or (iii) through unequivocal conduct that allows us to reasonably conclude that your authorization has been granted, such as the act of accepting the Privacy Policy. We may keep evidence of said authorizations, while respecting the principles of confidentiality and privacy of information.

As a data subject you have certain rights, including (i) to access, update and rectify your personal data; (ii) to request a copy of the consent you have given us; (iii) to be informed about how we have processed your personal data; (iv) to file claims before your country’s data protection authority; (v) to revoke the consent you have given us to process your personal data, unless the processing is based on compelling legitimate grounds or is needed for legal reasons; (vi) to ask for the suppression of your personal data (right to erasure); and (vii) to freely access your information. You can contact us to exercise any of these rights, using the information specified in Section 8 (Contact)

Egypt

By clicking “accept” or by proceeding with the sign up process, you acknowledge that you have read, understood, and consented to this Privacy Policy. You are acknowledging your consent to the processing, storage, and cross-border transfer of your personal data. The cross border transfer may be to any country in which we have databases or affiliates, in particular to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

You also acknowledge your consent to receiving marketing messages from us, whether through e-mails or pop-ups or other such means.

If you are a new user, you have seven days to inform us of any objection you may have to this Privacy Policy.

As an Egyptian data subject, you have certain rights under the Egyptian Personal Data Protection Law.

France

Instructions for the processing of your personal data after your death. You have the right to provide us with general or specific instructions for the retention, deletion, and communication of your personal data after your death. The specific instructions are only valid for the processing activities mentioned therein and the processing of these instructions is subject to your specific consent. You may amend or revoke your instructions at any time.

You may designate a person responsible for the implementation of your instructions. This person will be informed of your instructions in the event of your death, and be entitled to request their implementation from us. In the absence of designation or, unless otherwise provided for, in the event of the death of the designated person, their heirs will have the right to be informed of your instructions and to request their implementation from us.

When you wish to make such instructions, please contact us as set out in Section 8 (Contact).

Hong Kong

As a Hong Kong data subject you have legal rights in relation to the personal information we hold about you (to the extent permitted under applicable laws and regulations). You are entitled to make a subject access request to receive a copy of the data we process about you, a data correction request as well as a right to reject to the use of your personal data for direct marketing purposes. A fee may be chargeable by us for complying with a data access request.

India

Sensitive Personal Information

Sensitive Personal Information under local law includes passwords, financial information (such as bank account, credit card, debit card or other payment instrument details), biometric data, physical or mental health, sex life or sexual orientation, and/or medical records or history, but does not include information available in the public domain, or provided under Indian laws, including the Right to Information Act, 2005.

Sharing Of Your Sensitive Personal Information

Where we permit any third parties to collect and use Sensitive Personal Information, we shall use reasonable measures to ensure that the third parties do not further disclose the Sensitive Personal Information to the extent required by applicable laws.

Withdrawal Of Consent

To the extent provided by applicable laws and regulations, you may withdraw any consent you previously provided to us for certain processing activities by contacting us as set out in Section 8 (Contact). Where consent is required to process your personal information, if you do not consent to the processing or if you withdraw your consent, we may not be able to deliver the expected service. Where the processing of your personal data is not based on consent, our processing is based on certain legitimate uses as permitted under law and in compliance with applicable law.

Indonesia

By accepting and consenting to this Privacy Policy, you agree that we may collect, use and share your personal information in accordance with this Privacy Policy, as revised from time to time. If you do not agree to this Privacy Policy, you must not access or use our services and we have the right to not provide you with access to our services.

In the event we fail to maintain the confidentiality of your personal information in the Service, we will notify you through the contact information provided by you or via the Service, to the extent required by local laws and regulations.

You are responsible for making sure that any personal details which you provide to us are accurate and current. In order to confirm the accuracy of the information, we may also verify the information provided to us, at any time. You hereby represent that you have secured all necessary consent(s) before providing us with any other person’s personal information (for example, for referral promotions), in which case we will always assume that you have already obtained prior consent, and as such, you will be responsible for any claims whatsoever from any party arising as a result of the absence of such consent(s).

Japan

By clicking “accept”, you consent to the transfer of your personal information to third parties (if any), which may include the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information).

The categories of personal information specified in to the jurisdictions specified in Section 4 (How We Store and Share Your Personal Information) may include "special care-required personal information" (i.e., sensitive information as detailed under applicable law), and you consent to the collection of such information.

You may request us to notify you about the purposes of use of, to disclose, to make any correction to, to discontinue the use or provision of, and/or to delete any and all of your personal information which is stored by us, to the extent provided by the Act on the Protection of Personal Information of Japan. When you wish to make such requests, please contact us as set out in Section 8 (Contact).

Kazakhstan

By clicking “accept”, you consent to the collection, use, disclosure, transfer, export (to the extent permitted by applicable laws), sharing and storage of your personal information as described in this Privacy Policy. The transfer of your personal information to third parties, which may include the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, to Singapore.

In the event of any discrepancy or inconsistency between the English version and the Kazakh version of this Privacy Policy, the Kazakh version shall prevail.

Your Rights

Right of access: You have the right to request access to and obtain a copy of the personal information we have process about you or that is being processed on behalf of us. We reserve the right to impose a fee for providing access to your personal information in the amounts as permitted under law.

When handling a data access request, we are permitted to request for certain information to verify the identity of the requester to ensure that he/she is the person legally entitled to make the data access request.

Right to correction: You may request for the correction of your personal information or delete such personal information if it is impossible to correct it. When handling a data correction request, we are permitted to request for certain information to verify the identity of the requester to ensure that he/she is the person legally entitled to make the data correction request.
Right to blocking / de-blocking: You have the right to request the blocking of personal information related you, if you become aware of a violation regarding the collection and processing your data. If the violation has not been proved, you may request to de-block your data.
Right to deletion: You have the right to request deletion of your personal data if the collection and processing of your data has been conducted in violation of Kazakh laws.
Processing of your personal information in public sources of personal data: You may request to limit or provide your consent on the processing of your personal information in public sources of personal data.

Kingdom of Saudi Arabia

You consent to the collection, use, disclosure, transfer, export (to the extent permitted by applicable laws) and storage of your personal information as described in this Privacy Policy including (without limitation) for the purposes of showing you advertising when you use the services.

Kuwait

By accepting this Privacy Policy, you expressly state that you authorise us to collect, use, store, and process your personal data and to disclose this data to third parties whether inside or outside of Kuwait, in line with the provisions of this Privacy Policy.

Macau SAR

You have the right not to provide your personal information. However, as a result, we may not be able to provide the Service to you. As a Macau SAR data subject you have legal rights in relation to your personal information (to the extent permitted under applicable laws and regulations). You are entitled to make a subject access request to request a copy of the data we process about you, to make a data correction request, and have the right to oppose the use of your personal information for marketing or any other form of commercial prospecting, or on any grounds of personal nature. A fee may be chargeable by us for complying with a data access request.

Malaysia

Right of access: You have the right to request access to and obtain a copy of your personal information that we have collected and is being processed by or on behalf of us. We reserve the right to impose a fee for providing access to your personal information in the amounts as permitted under law. When handling a data access request, we are permitted to request for certain information to verify the identity of the requester to ensure that he/she is the person legally entitled to make the data access request.

Right of correction: You may request for the correction of your personal information. When handling a data correction request, we are permitted to request for certain information to verify the identity of the requester to ensure that he/she is the person legally entitled to make the data correction request.

Right to limit processing of your personal information: You may request to limit the processing of your personal information by using the contact details provided above. However, this may affect our provision of the Service to you.

To protect your personal information and handle complaints relating to your personal information, we have appointed the following department responsible for managing and protecting your personal information.

Our data protection officer, responsible for the management and safety of your personal information

Telephone: +603-22872388
Email: as set out in Section 8 (Contact)

Mexico

Some of the purposes of processing specified in Section 3 (How We Process Your Personal Information) are voluntary, which may include to show you personalised recommendations or advertising. We may also use your personal data for the voluntary purpose of sending information to your email that we may consider relevant to you.

In general, we do not require your consent to carry out the transfers detailed in Section 4 (How We Store and Share Your Personal Information). In any case, by using the Service and providing us with your personal data, you agree to the data transfers detailed therein that require your consent.

To understand more about and exercise your rights to “Access”, “Correction”, “Erasure”, “Objection”, “Restriction of Processing to Storage Only “, which includes the limitation to the use and disclosure of your personal data, and “Advertising” as well as the applicable means, procedures and requirements to exercise any of your rights, please contact us as specified in Section 8 (Contact).

Morocco

We collect information for purposes strictly necessary for the proper use of the Service. By accepting this Privacy Policy, you explicitly accept that your personal data may be subject to processing by the Service.

Kindly note:

the identity of the Data Controller is set out at the beginning of this Privacy Policy
the purposes of processing personal data are set out in Section 3 (How We Process Your Personal Information)
recipients or categories of recipients are set out in Section 4 (How We Store and Share Your Personal Information)
whether the answer to the questions is compulsory or optional, as well as the possible consequences of a lack of answer: please refer to Section 3 (How We Process Your Personal Information) and Section 7 (Your Rights)

New Zealand

We take reasonable steps to ensure that third party recipients of your personal information located outside New Zealand handle your personal information in a manner that is consistent with New Zealand privacy laws. However, you acknowledge that we do not control, or accept liability for, the acts and omissions of these third party recipients.

You have the right to access personal information we hold about you, how we use it, and who we share it with. You have the right to request the correction of any of your personal information we hold that is inaccurate.

If you are dissatisfied with our response to your request for access to, or correction of, your personal information or your privacy complaint in respect of your personal information, you may contact the Office of the New Zealand Privacy Commissioner (www.privacy.org.nz).

While we take reasonable steps to ensure that third party recipients of your personal information comply with privacy laws that are similar to those of your jurisdiction, you acknowledge and agree that we cannot control the actions of third party recipients and so cannot guarantee that they will comply with those privacy laws.

Peru

You may exercise rights related to the protection of personal information by requesting access to your personal information or the correction, deletion or suspension of processing of your personal information, pursuant to the Personal Data Protection Law (the “Law”). You may also exercise these rights through your legal guardian or someone who has been authorised by you to exercise the right. However, in this case, you must submit a power of attorney to us in accordance with the Law.

You can also withdraw your consent or demand a suspension of the personal information processing at any time.

If you consider that your request has not been met you may file a claim with the Peruvian National Authority of Personal Data Protection.

Data Protection Team, responsible for the management and safety of your personal information
Contact: as set out in Section 8 (Contact)

Philippines

You are entitled to the following rights:

Right to be informed. You may in certain circumstances have the right to be informed whether personal data pertaining to you is being, or has been processed, including the existence of automated decision-making and profiling.
Right to object. You may in certain circumstances have the right to object to the processing of your personal information, including processing for direct marketing, automated processing or profiling.
Right to access. You may in certain circumstances have the right to seek reasonable access to, upon request, your personal information.
Right to rectification. You may in certain circumstances have the right to dispute an inaccuracy or error in your personal information and have us correct it, unless the request is vexatious or otherwise unreasonable.
Right to erasure or blocking. You may in certain circumstances have the right to suspend, withdraw or seek the blocking, removal or destruction of your personal information.

By consenting to this Privacy Policy, you consent to us:

collecting and processing your personal information as described in Section 3 (How We Process Your Personal Information);
sharing your personal information with third parties, companies within our corporate group, and a third party that acquires substantially all or substantially all of us or our business, as described in this Privacy Policy and for the purposes stated herein; and
transferring or storing your personal information in destinations outside the Philippines as described in Section 4 (How We Store and Share Your Personal Information)

Qatar

If you are using the Service in Qatar, you consent (for the purposes of Law No. 13 of 2016 on the Protection of Personal Data, as may amended from time to time) to the processing of your information in accordance with this Privacy Policy.

Republic of Korea

We provide your personal information to third parties as described below:

Name of Recipient (and contact information)

Types of Personal Information provided

Purpose of Use by Recipient

Period of Retention and Use by Recipient

Harvest Sharp Limited

https://cdn.midaspayment.com/privacy-policy/Midaspay-PrivacyPolicy.html

dpo@centauriglobal.com

Transaction data and payment information.

To facilitate payment transactions in connection with the provision of services to support payment transactions.

See retention periods in the privacy policy:

https://cdn.midaspayment.com/privacy-policy/Midaspay-PrivacyPolicy.html

Trustpilot A/S

https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms

privacy@trustpilot.com

Trustpilot Information

To trigger a Trustpilot platform service review invitation for Midasbuy users

See retention periods in the privacy policy: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms

For the performance of the services detailed in this Privacy Policy, we delegate the processing of your personal information to the following professional service providers:

Delegatee	Description of Delegated Services
TENCENT CLOUD INTERNATIONAL PTE. LTD.	Data processor: Processes and stores data on behalf of Midasbuy.
Harvest Sharp Limited	Facilitates payment transactions in connection with the provision of services to support payment transactions.
Centauri Dynamic Pte. Ltd.	Performs data analysis on behalf of Midasbuy
Cybersource International Inc.	Provides risk management services to Midasbuy

Overseas Transfer of Personal Information

We transfer personal information to third parties overseas as follows:

*Recipient (Contact Information of Information Manager)*	*Country/region to which Your Personal Information is to be Transferred*	*Date and Method of Transfer*	*Types of Your Personal Information to be Transferred*	*Purposes of Use by Recipients*	*Period of Retention of Use by Recipient*
TENCENT CLOUD INTERNATIONAL PTE. LTD. cloudlegalnotices@tencent.com	Singapore	Transmitted from time to time	All personal information collected	Storage of personal information	For the data retention period specified under “Data Retention”
Cybersource International Inc. https://usa.visa.com/legal/privacy-policy.html privacy@visa.com	United States	Transmitted from time to time	Transaction Data	Risk management	For the retention periods in the privacy policy https://usa.visa.com/legal/privacy-policy.html
Centauri Dynamic Pte. Ltd. privacy@midas-go.com	Singapore	Transmitted from time to time	Transaction Data	Data analysis	For the data retention period specified under “Data Retention”

Data Destruction

Personal information is retained in accordance with the data retention periods as detailed in section “Data Retention”. With the exception of the personal information set out below, personal information, which has fulfilled the purpose for which it was collected or used, and has reached the period of time during which personal information was to be possessed, will be destroyed in an irreversible way. Personal information stored in electronic files will be deleted safely in an irreversible way by using technical methods, and printed information will be destroyed by shredding or incinerating such information.

The personal information detailed in section “Data Retention” are required to be retained pursuant to the following laws:

Act on the Consumer Protection in Electronic Commerce, Etc.

Article 6 of the Act on the Consumer Protection in Electronic Commerce

In an electronic commerce or a mail-order sale:

· Records regarding labelling and advertising (6 months)

· Records regarding execution or withdrawal of a contract (5 years)

· Records regarding the payment of a price and the supply of goods and services (5 years)

· Records regarding customer services or dispute resolution (3 years)

Protection of Communications Secrets Act

Article 41 of the Decree of the Act, Article 15-2 of the Protection of Communications Secrets Act

· Log records, IP address (3 months)

· The date of telecommunications by users, the time that the telecommunications start and end, the frequency of use (12 months)

You may exercise rights related to the protection of personal information by requesting access to your personal information or the correction, deletion or suspension of processing of your personal information, etc. pursuant to applicable laws such as the Personal Information Protection Act (“PIPA”). You may also exercise these rights through your legal guardian or someone who has been authorized by you to exercise the right. However, in this case, you must submit a power of attorney to us in accordance with the Enforcement Regulations of the PIPA. You can also withdraw your consent or demand a suspension of the personal information processing at any time.

Additional Use and Provision of Personal Information

In accordance with the PIPA, we may use or provide personal information within the scope of reasonably related to the initial purpose of the collection, in consideration of whether disadvantages have been caused to data subjects and whether necessary measures have been taken to secure such as encryption, etc. We will determine with due care whether to use or provide personal information in consideration of general circumstances including relevant laws and regulations such as the PIPA, purpose of use or provision of personal information, how personal information will be used or provided, items of personal information to be used or provided, matters to which data subjects provided consent or which were notified/disclosed to data subjects, impact on data subjects upon the use or provision, and measures taken to protect subject information. Specific considerations are as follows:

whether the additional use/provision is related to the initial purpose of the collection;
whether the additional use/provision is foreseeable in light of the circumstances under which personal information was collected and practices regarding processing;
whether the additional use/provision unfairly infringe on the interests of the data subject; and
whether the necessary security measures such as pseudonymization or encryption were taken.

Domestic Privacy Representative

Pursuant to the Article 32-5 of Network Act and Article 39-11 of the amended PIPA, the information regarding the domestic agent is as follows:

Name: Tencent Korea Yuhan Hoesa
Address: 152 Taeheran-ro, Gangnam-gu (Gangnam Finance Center, Yeoksam-dong), Seoul, Korea
Telephone: +82-2-2185-0902
Email: specified in Section 8 (Contact)

Contact

Data Protection Department, responsible for the management and safety of your personal information
Telephone: +82-2-2185-0902
Email: specified in Section 8 (Contact)

Russia

If you are using the Service in Russia, this section “Russia” applies to you. By using the Service you consent to:

for the purposes of the Russian Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” (as amended) or any replacement regulations, the processing of your information in accordance with this Privacy Policy; if legitimate interests, optimisation of the Service or carrying out of the contract are mentioned herein, you agree that, for the purposes of Russian law, the consent so provided can be considered an additional ground for processing (meaning that the processing is conducted with your consent); this consent also covers the processing of any cookies (to the extent that those qualify as personal data under Russian law);
the cross-border transfer of your information to any country where we have databases or affiliates, in particular as described in Section 4 (How We Store and Share Your Personal Information);
for the purposes of Article 152.1 of the Russian Civil Code, the processing of your image in accordance with this Privacy Policy; and
for the purposes of Federal Law “On Marketing/Advertising”, that we may share advertising/marketing communications with you, unless you have opted-out from such communications.

We will notify you of any material changes and may request you to acknowledge such changes. Unless we require your acknowledgment, you shall be deemed to have agreed to the changes if you continue using the Service after the notification.

As regards the representative for Russia, you can contact us as specified in Section 8 (Contact). Please include the word “Russia” in the subject line of your email.

Separate consent for using certain data

For the purposes of the operation of the Service, as part of its activities, we do not distribute (publicly disclose) personal data without the appropriate consent of the data subject and in compliance with the requirements of Article 10.1 of Russian Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” (as amended).

By using the Service you also consent to the sharing of your personal information with certain third parties for the purposes set out under section 4 “How We Store and Share Your Personal Information”.

You determine, in your discretion, the terms of disclosure to the general public of your personal data, by choosing to use certain features of the Service and by choosing the appropriate privacy settings in respect of your personal information in the Service.

We process your personal information subject to the terms of this Privacy Policy and your chosen features and settings.

This consent is granted for as long as you use the Services. The consent may be withdrawn by you (and you may set any restrictions on processing of your relevant personal information) at any time by contacting us at email set out at Section 8 (Contact): please include the word “Russia” in the subject line of your email.

Serbia

Our designated local representative in Serbia is Karanovic & Partners for the purposes of compliance with the Law on Personal Data Protection, and can be contacted at local.representative@karanovicpartners.com. Please include the word “Serbia” in the subject line of your email.

Name: Karanovic & Partners o.a.d. Beograd
Address: Resavska 23, Belgrade, 11000, Serbia
Telephone Number: +381 11 3094 200

E-mail: local.representative@karanovicpartners.com

Singapore

By clicking “accept”, you consent to the cross-border transfer of your information to any country where we have databases or affiliates and, in particular, the locations specified in Section 4 (How We Store and Share Your Personal Information).

You have the right to access your personal information, how we use it, and who we share it with. You have the right to correct any of your personal information that is inaccurate.

Our designated data protection officer for the purposes of compliance with the Personal Data Protection Act 2012 can be contacted as set out in Section 8 (Contact).

South Africa

You have the right to lodge a complaint with the Information Regulator (South Africa) by emailing it at inforeg@justice.gov.za. The Information Regulator (South Africa)’s physical address is 33 Hoofd Street Forum III, 3rd Floor Braampark, Braamfontein, Johannesburg, South Africa.

Sri Lanka

By clicking “accept”, you consent to the Privacy Policy and permit the collection, use and disclosure of your personal information.

Thailand

By clicking "accept", you acknowledge that you have read, understood, and agree to the Privacy Policy. If you do not agree with the Privacy Policy, you must not use the Service.

To the extent provided for by the Thai Personal Data Protection Act (PDPA), you may:

withdraw your consent to the processing of your personal data (only where the legal basis for our processing is consent); however, please note that where consent is required to process your personal data, we may not be able to deliver the expected service without it;
request us to provide you access to, make any correction to, cease any automated processing or profiling (if applicable), discontinue, restrict the use or provision of and/or erase your personal data;
request us to provide you or a third party with your personal data which is stored by us in a machine readable format; and/or
lodge a complaint to a relevant authority.

Where you wish to make such requests, please contact us as set out in Section 8 (Contact).

The contact details of our designated local representative in Thailand for the purposes of compliance with the PDPA is as set out in Section 8 (Contact) and can be contacted via email. Please include the word “Thailand” in the subject line of your email.

Türkiye

You have legal rights, which are set forth in Article 11 of the DPL, in relation to the personal information data we hold about you. As a Turkish data subject, you may have the right to apply to the data controller and (to the extent permitted under applicable laws and regulations):

learn whether or not your personal data has been processed;
request information about processing if your personal data has been processed;
learn the purpose of processing of your personal data and whether they have been used accordingly;
know the third parties in the country or abroad to whom personal data has been transferred;
request rectification in the event personal data is incomplete or inaccurate and to demand the operations in this regard be reported to third parties your personal data has been transferred to;
request deletion or destruction of personal data within the framework of the conditions set forth under Article 7 of the DPL and to demand the operations in this regard be reported to third parties your personal data has been transferred to;
object the occurrence of any consequence that is to your detriment by means of analysis of personal data solely through automated systems; and
demand compensation for the damages that you have suffered as a result of unlawful processing of your personal data.

In accordance with Article 9 of the DPL, your personal data may be transferred abroad as follows:

Identity of the overseas recipient	Location of the recipient (or as otherwise stated in the recipient’s privacy policy)	Purposes of use of Personal Information by the recipient	Items of Personal Information to be provided
TENCENT CLOUD INTERNATIONAL PTE. LTD. cloudlegalnotices@tencent.com	Singapore	Storage of personal information	All personal information collected
Cybersource International, Inc. https://usa.visa.com/legal/privacy-policy.html privacy@visa.com	United States	Risk management	Transaction Data
Harvest Sharp Limited https://cdn.midaspayment.com/privacy-policy/Midaspay-PrivacyPolicy.html dpo@centauriglobal.com	Singapore	To facilitate payment transactions in connection with the provision of services to support payment transactions.	Transaction data and payment information.
Centauri Dynamic Pte. Ltd. privacy@midas-go.com	Singapore	Data analysis	Transaction Data

Ukraine

By accepting this Privacy Policy, you expressly authorize us to collect, use, store, and process your personal data, including disclosing to third parties and transferring to countries or regions other than Ukraine, to the extent and for the purposes provided in this Privacy Policy.

United Arab Emirates

You consent to the collection, use, disclosure, transfer, export (to the extent permitted by applicable laws), sharing and storage of your personal information, as described in the Privacy Policy.

We may voluntarily report a cyber-security incident where it constitutes a crime under UAE law (e.g. under the UAE Cybercrime Law). The incident can be reported to the relevant authorities for the purpose of investigations. Please note that voluntary reporting of a cyber-security incident can also be made to the UAE Computer Emergency Response Team (“CERT”). CERT is a security awareness organisation that provides a process for logging incidents and advising on known cyber security threats in the UAE.

Vietnam

By accepting this Privacy Policy, you expressly agree and authorise us to collect, use, store, and process your personal information, including, lawfully disclosing and transferring it to third parties, as described in this Privacy Policy.

Where we permit any third parties to collect and use your personal information, we shall take reasonable measures to ensure that the third parties do not further disclose the personal information.

You have the right to access, correct, and erase the personal information we hold about you. You also have the right to withdraw your earlier provided consent to collect, store, process, use and disclose your personal information and to request us to stop providing your personal information to a third party.

Virginia

This section applies to Virginia residents covered by the Virginia Consumer Data Protection Act (“VCDPA”). For purposes of this section, “personal data” and “sensitive personal data” have the meanings given in the VCDPA and do not include information excluded from the VCDPA’s scope.

If you are a Virginia resident and the law does not recognize an exception that applies to you or your personal data, you have the right to:

request that we disclose to you the personal data that we collect, use, or disclose, and information about our data practices;
request we delete personal data we collected from you, unless the law recognises an exception;
request we correct inaccurate personal data that we maintain about you; and
be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or denying goods or services to you when you exercise your rights under the law.

We do not collect sensitive personal data about you. We also do not process personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

How to Exercise Your Rights

First, you may wish to log into your account and manage your data from there. If you are a Virginia resident to whom the VCDPA applies, you may also exercise your rights, if any, regarding other data by contacting us as specified in Section 8 (Contact)

How to Appeal Decision on Your Request

If you would like to appeal a decision on your request to exercise any right you have under the VCDPA, you may contact us as set out in Section 8 (Contact).

*What information do we need to be able to provide the Service?*	· If you register an account to use the Service then we will need some information from you to set this up. If you register for a Level Infinite Account, this includes a user token and open ID. If you choose to set up your profile using a social media account, we also collect information including email, profile picture and nickname from that social media account. If you need to get in touch with us, we will retain some information so that we can get back in touch with you and address any concerns. We will also process some information when you use the Service (e.g., to facilitate your transactions) or when you only browse the Website as a guest (to the extent this function is available in your region) or when you access the Service via the App. Depending on your use of the Service and the jurisdiction where you are based, you may also need to provide some additional information to help us set up your account.	More Information.
*How will we use your information?*	· We use your information to provide the many functions and services that comprise the Service. We also use your information for account verification, security purposes, to conduct AML/KYC/sanctions checks, and to support and improve the Service. We do not share your information with any third parties, except where we need to in order to provide the Service (e.g., use local cloud providers or to back up your data; use our affiliates around the world to help us to deliver the Service), or where we are instructed to by a court, authority or compelled by law.	More Information.
*Who do we share your information with?*	· We use some third parties to help us deliver the best possible experience (e.g., cloud services to back up your data and support services, service providers to identify fraudulent or suspicious transactions, process your payments, and conduct data analysis). When we use a third party, we only do this to process or store your information for the purposes described in this Privacy Policy. We notify the merchants of your payment, transaction, refund and/or subscription so that they can proceed with order fulfilment for the purchases or subscriptions you made. We also have affiliates around the world who help us deliver the Service and we may be required by a court or legal obligation to disclose certain information in some circumstances.	More Information.
*Where do we process your information?*	· Our servers are located in Singapore. Your information can be accessed from outside of where you live by our support, engineering and other teams in Singapore and China.	More Information.
*How long do we keep your information?*	· We generally retain your information for the period during which you use the Service (or have credits which may be used to purchase virtual goods and items (“Game Credits”)) after which time your data is deleted (as further described in this Privacy Policy), unless otherwise required by applicable laws.	More Information.
*How can I exercise my rights over my information?*	· Depending on where you are, you may have certain rights with respect to your information, such as rights of access, to receive a copy of your data, or to delete your data or restrict or object to our processing of your data.	More Information.
*How will we notify you of changes?*	· Changes to this Privacy Policy will be posted here. Please check this page frequently to see if there are any updates or changes to this Privacy Policy.	More Information.