1. TYPES OF INFORMATION WE COLLECT
Information You Provide

We and our Service Providers (defined below) collect Information you provide directly via the Services. For example, we collect Information when you browse our website, apply for a job, or otherwise communicate with us through the Services. The categories of Information we collect may include:

• Contact Identifiers , including your name, email address, postal address, and phone number.
• Payment Information including your payment instrument number (such as a credit or debit card number), expiration date, and security code as necessary to process your payments. This information is processed by our payment processors.
• Professional, employment, or education-related information including your employment and work history, transcripts, writing samples, references, and other information necessary to consider you for a job.

2. HOW WE USE YOUR INFORMATION
We use your information in accordance with the practices described in this Privacy Policy, which may include:

• to manage our Services;
• to inform you of changes to the Services and/or any of the Services’ policies;
• to prevent and address fraud, breach of policies or terms, and threats or harm;
• to monitor and analyse trends, usage, and activities;
• to improve the Services or create new service offerings or to customize your experience on the Services;
• for internal business purposes; and
• for purposes disclosed at the time you provide your information or as otherwise set forth in or as permitted by this Privacy Policy.

3. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
We disclose Information about you in accordance with the practices described in this Privacy Policy, including under the following circumstances:

Service Providers. We disclose your Information to our agents, vendors, consultants, and other service providers that we engage to act on our behalf (“Service Providers”) for the purpose of processing Information on our and your behalf, operating or hosting the Services, or providing services related to the online components of our games. As required by law, these Service Providers are prohibited from using your Information other than to provide this assistance (although we may permit them to use information that does not identify you for other purposes) and are required to maintain appropriate confidentiality and security measures.

Partners.We disclose your Information with our publishing partners and their affiliates in connection with the online components of our apps and games. Where we act as a service provider for a publishing partner with respect to an app or game that posts the publishing partner’s privacy policy, the publishing partner’s data practices will apply for that app or game, and you should review their privacy policy.

Protection of Rights. We must disclose your information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may also share your information if we have a good faith belief that (i) access, use, preservation or disclosure of such information is reasonably necessary to satisfy any applicable law, regulation, legal process, such as a court order or subpoena, or a request by law enforcement or governmental authorities, (ii) such action is necessary to detect, prevent, or otherwise address fraud, security or technical issues associated with the Services or violations of our Terms of Use, or (iii) such action is appropriate to protect the rights, property or safety of us, our employees, partners, or users of the Services or others.

Asset transfers. If we become involved in a merger, acquisition, bankruptcy or other transaction involving the sale of some or all of TRS’ assets or a line of business, your Information could be included in the discussions and transferred assets.

Consent and Pursuant to this Privacy Policy. We may disclose your Information with your consent or for any purposes consistent with our statements under this Privacy Policy or as permitted by applicable law.

Without limiting the foregoing, in our sole discretion, we may disclose aggregated information which does not identify you or de-identified information about you with third parties or affiliates for any purpose.

4. ADDITIONAL INFORMATION YOU SHOULD KNOW ABOUT THIRD PARTIES
This Privacy Policy does not cover the information practices of third parties. When you click on a third party logo or URL displayed on our Services which links you to a third party service, our Privacy Policy no longer applies and you must read the privacy policy of the third party service to see how your Information will be handled on their service. If you cannot find their privacy policy, then you should contact the respective webmasters of those websites to obtain information regarding their information collection, use and disclosure policies. We are not responsible for their collection and use of your Information

5. SOCIAL MEDIA FEATURES
Our Services may link to or interface with Facebook, X (formerly Twitter), Discord, Threads, Instagram, Reddit, and other social media platforms. Any Information you provide to us when you engage with our content (such as through our brand page) or provided to us via our social media platforms is treated in accordance with this Privacy Policy. Also, if you publicly reference our Services on social media (e.g., by using a hashtag associated with us in a tweet or post), we may use your reference on or in connection with our Services. You should review the applicable social media platform’s privacy policy before using such platform as they may independently collect and solicit information from you.

6. ANALYTICS AND TRACKING TECHNOLOGIES
We may use analytics services, such as Google Analytics, to help us understand how users access and use the Services. As part of this process, we may incorporate tracking technologies into our own Services (including our website) as well as into our ads displayed on other websites and services.

For further information on tracking technologies and your choices regarding them, please see “Information We Collect Automatically” above and “Your Privacy Choices” below.

7. YOUR PRIVACY CHOICES
Tracking Technologies Generally

Regular cookies may generally be disabled or removed by tools available as part of most commercial browsers, and in some instances blocked in the future by selecting certain settings. Browsers offer different functionalities and options so you may need to set them separately.

Please be aware that if you disable or remove these technologies some parts of the Services may not work and that when you revisit the Services your ability to limit browser-based tracking technologies is subject to your browser settings and limitations.

Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. Note, however, there is no industry consensus as to what website and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take any action with respect to these "Do Not Track" signals or other mechanisms. For more information on "Do Not Track," visit http://www.allaboutdnt.com.

Analytics and Tracking Technologies

If we use Google Analytics, you may exercise choices regarding the use of cookies from Google Analytics by going to https://tools.google.com/dlpage/gaoptout or downloading the Google Analytics Opt-out Browser Add-on.

Region Specific Rights

Some regions provide additional rights by law. For example, residents of California, Colorado, Connecticut, Utah, Virginia, Nevada, the European Economic Area, Switzerland, and United Kingdom may have additional rights. This subsection details how you may exercise some of those rights to the extent they apply to you.

• Data Subject Requests To access, correct, delete, or exercise similar rights available to you in your region with respect to your Information, please submit a request to our email at privacy@turtlerockstudios.com. We acknowledge that you may have rights in certain regions in connection with the Information we process on behalf of our publishing partners. If Information has been processed by us as a service provider on behalf of a publishing partner and you wish to exercise any rights you have with such personal information, please inquire with the publishing partner directly. If you wish to make your request directly to us, please provide the name of the publishing partner on whose behalf we processed your Information. We will refer your request to that publishing partner, and will support them to the extent required by applicable law in responding to your request.

8. INTERNATIONAL TRANSFER
The Services are operated in the United States. Please be aware that information we collect will be transferred to, and processed, stored and used in the United States and other jurisdictions. The data protection laws in the United States and other jurisdictions may differ from those of the country in which you are located, and your information may be subject to access requests from governments, courts, or law enforcement in the United States and other jurisdictions according to applicable law. By using the Services or providing us with any information, you consent to the transfer to, and processing, usage, sharing and storage of your information in the United States and other jurisdictions as set forth in this Privacy Policy.

9. CHILDREN'S PRIVACY
We are a general audience service and we do not knowingly collect any personal information from children under the age of 13 as defined by the U.S. Children’s Privacy Protection Act. If you are a child under 13 years of age, you are not permitted to use the Services and should not send any information about yourself to us through the Services. If you are a parent or guardian and believe we have collected personal information from children, please contact us at privacy@turtlerockstudios.com.

10. WHAT SECURITY MEASURES DO WE TAKE TO SAFEGUARD YOUR PERSONAL INFORMATION?
The information that you provide to us is stored on servers that are located in secured facilities and protected by protocols and procedures designed to help protect the security of such information. However, no server, computer or communications network or system, or data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we strive to protect user information, we cannot ensure or warrant the security of any information you transmit to us or through the Services and you acknowledge and agree that you provide such information and engage in such transmissions at your own risk.

11. ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS
These additional disclosures apply only to California residents. The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (collectively, the “CPRA”) provides additional rights to know and delete and requires businesses collecting or disclosing personal information to provide notices and means to exercise your rights.

Notice of Collection

At or before the time of collection of your personal information, you have a right to receive notice of our data practice. Our data practices are as follows:

• For the categories of personal information we have collected in the past 12 months, see the Types of Information We Collect section above.
• For the categories of sources from which personal information is collected, see the Types of Information We Collect section above.
• For the specific business and commercial purposes for collecting and using personal information, see the How We Use Your Information section above.
• For the categories of third parties to whom information is disclosed, see the How We Disclose Your Personal Information section above.

• The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which personal information is collected, the business or commercial purposes for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• The right to correct inaccurate personal information that we maintain about you.
• The right to delete personal information we have collected from you.

12. ADDITIONAL DISCLOSURES FOR DATA SUBJECTS IN COLORADO, CONNECTICUT, UTAH, AND VIRGINIA
These additional rights and disclosures apply only to residents of Colorado, Connecticut, and Virginia. Terms have the meaning ascribed to them in the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act, as applicable.

In your region, you have the following rights under applicable law:

• To confirm whether or not we are processing your personal data
• To access your personal data
• To correct inaccuracies in your personal data
• To delete your personal data
• To obtain a copy of your personal data that you previously provided to us in a portable and readily usable format

• For Colorado residents, to the Colorado AG at https://coag.gov/file-complaint/
• For Connecticut residents, to the Connecticut AG at https://www.dir.ct.gov/ag/complaint/
• For Virginia residents, to the AG at https://www.oag.state.va.us/consumercomplaintform

13. ADDITIONAL DISCLOSURES FOR DATA SUBJECTS IN NEVADA
If you are a Nevada consumer, you have the right to direct us not to sell certain Information that we have collected or will collect about you. To exercise this right, please follow the instructions in the Your Privacy Choices Section above.

14. ADDITIONAL DISCLOSURES FOR DATA SUBJECTS IN EUROPE
These additional disclosures and rights apply only to individuals located in the European Economic Area, Switzerland, or the United Kingdom (collectively, “Europe”). Terms have the meaning ascribed to them in the General Data Protection Regulation (“GDPR”).

Roles

Data protection laws in Europe distinguish between organizations that process personal data for their own purposes (known as “controllers”) and organizations that process personal data on behalf of other organizations (known as “processors”). We act as a controller with respect to personal data collected as you interact with our Services. In some instances, we act a processor on behalf of a publishing partner, which is the controller. Any questions that you have relating to the processing of personal data by us as a processor should be directed to the relevant publishing partner.

Lawful Basis for Processing

Data protection laws in Europe require a “lawful basis” for processing personal data. Our lawful bases include where: (a) you have given consent to the processing for one or more specific purposes, either to us or to our service providers, partners, or publishing partners; (b) processing is necessary for the performance of a contract with you; (c) processing is necessary for compliance with a legal obligation; or (d) processing is necessary for the purposes of the legitimate interests pursued by us or a third party, and your interests and fundamental rights and freedoms do not override those interests. Where applicable, we will transfer your personal data to third countries subject to appropriate or suitable safeguards, such as standard contractual clauses discussed below.

Your Data Subjects Rights

You have the right to access, rectify, or erase any personal data we have collected about you. You also have the right to data portability and the right to restrict or object to our processing of personal data we have collected about you. You may withdraw your consent at any time for any data processing we do based on consent you have provided to us. To exercise any of these rights, follow the instructions for data subject requests in the Your Privacy Choices section above. We will respond to your request within 30 days. We may require specific information from you to help us confirm your identity and process your request. If personal data about you has been processed by us as a processor on behalf of a publishing partner and you wish to exercise any rights you have with such personal data, please inquire with our publishing partner directly. If you wish to make your request directly to us, please provide the name of our publishing partner on whose behalf we processed your personal data. We will refer your request to that publishing partner, and will support them to the extent required by applicable law in responding to your request.

Please note that we retain information as necessary to fulfil the purposes for which it was collected, and may continue to retain and use information even after a data subject request for purposes of our legitimate interests, including as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

We retain Information for the length of time that is reasonably necessary for the purpose for which it was collected, and as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

If you have any issues with our compliance, please contact us. You also have the right to lodge a complaint with the data protection regulator in your jurisdiction.

Data Privacy Framework

TRS complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, United Kingdom, and Switzerland to the United States. TRS has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF, and from Switzerland in reliance on the Swiss-U.S. DPF Principles (“Swiss-U.S. DPF Principles) (collectively, the “Principles”). If there is any conflict between the terms in this Privacy Policy and the Principles, the Principles shall govern personal data processed in reliance on the Data Privacy Framework (“DPF”). To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

TRS’ responsibility for personal data it receives in reliance on the DPF and subsequent transfers of that personal data to third parties is detailed in the Principles. Where TRS relies on the Principles for onward transfers from the EU, the UK, and Switzerland, including the onward transfer liability provisions, TRS is responsible under the Principles for third-party agents processing personal data on its behalf.

With respect to personal data received or transferred pursuant to the DPF, TRS is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Individuals with questions or complaints regarding this Privacy Policy should first submit inquiries by contacting us using the details provided under the “Questions? Contact Us” section below. TRS has further committed to refer unresolved complaints regarding personal data transferred in reliance on the DPF to JAMS, an alternative dispute resolution provider located in the United States at https://www.jamsadr.com/dpf-dispute-resolution. Under certain limited circumstances, you may seek a remedy through binding arbitration to be provided to you in accordance with the DPF Principles. To learn more about the DPF, and to view our certification, please visit https://www.dataprivacyframework.gov/s/participant-search.

15. UPDATING THIS PRIVACY POLICY
We may modify this Privacy Policy from time to time in which case we will update the “Effective” date at the top of this Privacy Policy. If the changes are material, we may provide additional notice to you, such as through email or prominent notice on the Services. However, it is your sole responsibility to review the Privacy Policy from time to time to view any such changes. The updated Privacy Policy will be effective as of the time of posting, or such later date as may be specified in the updated Privacy Policy. If you do not accept and agree to this Privacy Policy, including any changes, then you must not access or use the Services. To the extent any provision of this Privacy Policy is found by a competent tribunal to be invalid or unenforceable, such provision shall be severed to the extent necessary for the remainder to be valid and enforceable.

16. QUESTIONS? CONTACT US
If you have any questions about our privacy practices or this Privacy Policy, or experience any difficulties accessing the information here, please contact us at:

Email: privacy@turtlerockstudios.com

Address: Turtle Rock Studios, Inc., 25422 Trabuco Road #105-491, Lake Forest, CA 92630; Attn: Legal Department.