Privacy Notice

Last updated 18 March 2024

This Privacy Notice explains who we are, how we collect, process, and share personal data about you, and how you can exercise your privacy rights. This Privacy Notice applies to personal data we collect and process through our games, mobile applications, and other products (“Games”) and websites such as www.metacoregames.com and www.mergemansion.com (“Websites”) (together “Services”).

From time to time, we may change this Privacy Notice due to changes in our business operations, technologies, industry practices or regulatory requirements. If we make any material changes to this Privacy Notice, we will notify you separately as required under the applicable law.

Data Controller

Metacore Games Ltd acts as the data controller. Data controller is the entity that determines how and why your personal data is processed.

This Privacy Notice discusses also sharing of data with other parties. Some of the entities we share your personal data with independently determine how and why they process your personal data and are therefore data controllers as well. For more information on these partners and use of data see section “who can access your personal data” below.

How to contact us?

If you have any questions about data protection, the processing of your personal data or you wish to exercise your rights as a data subject, we kindly ask you to contact us through the support feature within our Games and Websites. Alternatively, you may contact us at:

Metacore Games Ltd

Attn: Data Protection Officer

Porkkalankatu 24

00180 Helsinki

Finland

privacy[at]metacoregames.com

What data do we collect and process?

The categories of personal data we collect depend on the Services you use. You may provide data to us directly such as your player name or contact information. We collect data automatically such as automatically created playerID, customer relationship data and gameplay data (level and game events). We may obtain data from third parties as well, such as third-party account data like Facebook, Google and Apple. We may collect information about your interactions with in-game ads, when you see our ads outside of our Services.

Please note that providing personal data to us is not mandatory, but we are unable to provide our Services, or some parts of them without processing of your personal data.

The sources of the personal data we process can be divided into three categories:

Data you provide us:

• Contact information such as your name, email address or other contact information (e.g. when contacting our customer service),

• Your age or information about when you were born,

• Player name and user credentials,

• Messages, chat logs and other content you submit when you use our Services, contact our customer support or interact with other players inside the Services,

• Payment details and financial information in connection with the purchases you make through the Services and the related refunds,

• Marketing & communication preferences, and

• Other data you may provide to us in connection with different surveys, promotions, competitions and other events.

Data we collect automatically when you interact with our Services:

• Account identifiers automatically created by us such as PlayerID,

• Customer relationship details, such as contract start and end date and the Services ordered,

• Online identifiers like your IP address, mobile device identifiers, and identifiers we assign to your account and other electronic network activity information,

• Data about your device, such as device model, type and used language, operating system and hardware information,

• Gameplay data such as your level and different game events,

• Coarse location (e.g. country, state, or city) inferred from your IP address,

• Data collected via cookies and similar technologies such as cookieID’s and activities within our Services, and

• Information relating to bugs, errors and other information we gain when you encounter issues in our Services and crash logs.

Data obtained from 3rd parties:

• 3rd party account details if you decide to login using 3rd party tools or services such as Facebook, Google, Apple or Supercell,

• Contact and account information from our partners who operate our Games related webstore and similar services,

• Payment verification details when you make a purchase through our payment service providers,

• Data you make available on different social media channels such as your posts and account name,

• Demographic data and segments that we use to target our advertising; and

• Data related to surveys and questionnaires organized by our partners.

We do not intend to collect or otherwise process any special categories of data relating to you. Special categories of data mean genetic, biometric or health information, information revealing racial or ethnic origin, sex life or sexual orientation, political opinions, religious or philosophical beliefs or trade union membership, or information about your criminal offenses or convictions. This kind of information is not necessary to use our Services. Do not provide this kind of information to us or use the Services to make it available to others.

Why do we process and on what basis we process your personal data?

We have a reason to process your personal data and this section discusses the reason and legal basis for processing your personal data. We may use your personal data for connection with our Services based on performance of contract, our legitimate interest and/or your consent.

As a summary we collect your personal data for the following reasons:

We process your personal data to provide the Services to you like operating the Services, saving your game progress, and verifying and confirming payments. We process your personal data to provide Services to players and process data for purposes like updating and developing the Services and experience, managing our relationship with you, troubleshooting issues you encounter in Games or moderating our Games and improving the Services (for example, by running surveys to get your feedback).

Moreover, we may show ads to you in our Games or advertise our Services to you on third-party properties and may use your personal data to make this possible and to make those ads relevant to you. As our Games are free to download and can be played free of charge, the advertising is a means to fund our Games.

Your personal data that we process is in many cases pseudonymous data. This is to say the data collected and processed does not directly identify you. This is for example the case e.g. with advertising identifiers, player ID, which as such are pseudonymous data.

From time to time, we may need to use your personal data for other purposes such as fraud prevention, auditing, or compliance.

In addition to comply with our legal obligations, we process your personal data under different legal bases, namely: (i) performance of a contract: (ii) legitimate interest: and (iii) consent.

To perform the contract between you and us

• Providing the Services. The primary purpose of processing your personal data is to provide you with the Services. For example, when you play Games, we process your game events and PlayerID to enable the gameplay.

• Payments and refunding. When you make a purchase or ask for a refund, we need to process your payment details.

• Service related communication. We are constantly improving our Services and we use your information (contact details) to communicate with you regarding the Services and their updates.

Our legitimate interests

• Analyzing, reporting and Services development. When you use our Services (e.g. play Games, visit our Websites or make a purchase), we collect personal data to analyze and learn how the Services are used. We use this information to maintain and improve the quality of the Services, to develop new games and services and to gather certain insights for our internal reporting.

• Customer support. When you send us a message or contact our customer support, we will process your contact details to respond to your inquiries.

• Social media management. When you tag us on social media or post a message on our channels, we collect certain information to monitor and analyze our social media presence.

• Marketing and advertising outside our Games. We collect and process personal data for creating audiences and to show advertisements, via other communication channels (for example on other websites or mobile apps). We also collect information from these advertising campaigns to measure and improve the effectiveness of our advertising.

• Serving advertisements in our Games. We may show ads to you in our Games, either directly from us or our advertising partners. We may also keep track of your activity in our Games to learn about your interests and improve the advertising in our Games, or personalize the ads you see in our Games to make them more relevant to you.

• Information security. We are collecting logs and other information from the use of our Services to analyze and detect frauds or misbehavior to keep our Services safe for everyone.

• Content moderation. We monitor the content, such as chats and player names, to clean up and block acts of disruptive behavior on our Services.

With your consent

• Cookies. With your consent, we use certain cookies to collect information about your use of the Websites to analyze how our Websites are used and to display targeted advertising on different communication channels.

• Player surveys. From time to time, we may contact you about surveys when we want to gather feedback on our Services or to learn more about our players.

• Advertisements. In certain regions and circumstances, we may ask for your consent to show ads to you in our Games, either directly from us or our advertising partners. When we ask for your consent, we will provide additional information on the purposes, our partners and how they use your personal data.

• Sending you newsletters and other information you have subscribed to.

• Asking for your exact location e.g. your GPS location for location based experiences.

Who can access your personal data and who do we share your personal data with?

Instead of doing everything on our own, we rely on certain service providers and other partners to provide data processing services for us for the purposes described in this Privacy Notice.

Please note that certain recipients such as payment service providers, social media and advertising partners, development partners and third-party account providers may process your personal data as data controllers under their own privacy policies. A list of our partners is available here. The list of our partners is updated from time to time, and we advise you to periodically review the list when using the Services.

Depending on the Services you use, we might share your personal data with the following categories of recipients and your personal data can be accessed by others:

• Metacore group companies.

• 3rd party account providers. We have integrated 3rd party accounts, such as Google Account, Facebook login, Sign in with Apple and Supercell ID, to our Services. To enable easy login options, these account providers will receive your personal data and process it under their own privacy policies.

• Advertising partners. When we request our advertising partners to show our advertising campaigns, we may disclose a limited amount of your personal data (such as information about the segmenting) to enable our partners to deliver an ad that is relevant to you. To monitor the effectiveness of our advertising campaigns and to prevent ad frauds, we also disclose information about your device and installs to our advertising partners.

• We may disclose the same information to our advertising mediation partners.

• Analytics providers. We use tools provided by 3rd parties to collect and gather personal data for analytics and reporting purposes.

• Payment service providers. We use payment processors to process your payment transactions on our behalf. They have access to your credit card data.

• Partners working for us, such as IT-service providers and consultants who process your personal data on our behalf and in accordance with our instructions.

• Social media partners who provide advertising services, social media interaction tools or other functionalities to our Services.

• Server and datacenter providers who provide data center and IT-infrastructure related services (like hosting of data) for us.

• Potential or actual buyers (and their agents and advisers) in connection with any proposed or actual purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Privacy Notice.

• Other organizations and public authorities such as competent law enforcement or regulatory bodies, government agencies, courts or other third parties where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.

Do we transfer your personal data outside the EU?

Our Services are global by nature and therefore your personal data is transferred to countries outside the European Union and the European Economic Area in certain situations. These countries may have data protection laws that are different to the laws of your country.

Specifically, our servers are located around the world, and our group companies and third-party service providers and partners operate around the world. This means that when we collect your personal data, it can be processed in any of these countries.

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. We may transfer data outside of EU/EEA subject to EU commission adequacy decisions or appropriate safeguards. These safeguards may include having standard contractual clauses approved by the EU Commission or implementing other safeguards required by law.

How long do we keep your personal data?

We retain personal data we collect from you where we have an ongoing legitimate business need or a legal obligation to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). We may periodically delete or anonymize inactive accounts or data in our Services.

When your personal data is no longer necessary to fulfill the purposes for which it was collected, as defined in this Privacy Notice, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. When your personal data is anonymized the data cannot be associated with you.

Cookies and similar technology

We use cookies and similar tracking technology such as software development kits (collectively, “Cookies”) on our Services.

A "Cookie" is a piece of information that is stored on a user's computer, tablet or phone when they visit a website. Cookies can be set by either the website you visit (“first-party cookies”) or a third party involved in providing content, functionality, or services such as analytics or advertising for the website you visit (“third-party cookies”). Cookies can help in identifying a user's device when they use a mobile application or visit a website and remember helpful details of the use and the choices made by the user to improve the user experience.

Cookies cannot be used alone to identify an individual, but they may be linked directly or indirectly to an identifiable individual when combined with other information. In these cases, cookies may be treated as personal data. If we identify a user based on cookies, we make sure that all cookie information is processed as personal data in accordance with applicable data protection laws.

The cookies we use include:

• Essential cookies: These cookies are essential to provide the Websites and are needed to enable the proper use of some of its features.
• Functionality cookies: These cookies allow us to remember choices you make when using the Websites.
• Tracking and performance cookies: These cookies are used to track information about traffic to the Websites and how users use the Websites. We may also use these cookies to serve interest-based advertising.

You may also prohibit the use of cookies by changing your browser or device settings. Depending on your browser or device, you may also limit the use of cookies or remove specific cookies from your browser or device settings. However, cookies are an important part of how a web service works, so limiting the use of cookies may affect the functionality of our Websites.

How does Metacore Games keep your personal data secure?

We use appropriate technical and organizational measures designed to protect your personal data that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal data.

The security measures are designed to protect your personal data against accidental or unlawful destruction, loss, or alteration as well as unauthorized disclosure or access. The specific measures typically include encryption in transit, pseudonymization of identifying data where feasible, controls to limit access to services or systems that contain personal data and maintaining procedures to handle any suspected security incidents. Please consider that the internet is an inherently insecure environment, and we cannot guarantee absolute security for your personal data.

Your rights as a data subject

The law guarantees you certain rights regarding the personal data we hold and process. Please note, however, that these rights are not absolute. For example, we are not able to delete your personal data if we have a legal obligation to retain it. To exercise your rights, we kindly ask you to contact us by either using the support feature in our Services or to contact us in the address mentioned above.

• You have the right to request access to personal data we hold about you. In addition, you have the right to request a copy of such data.

• You have the right to request rectification of your personal data, restrict the processing of your personal data and request the erasure of your personal data. However, certain information is strictly necessary to fulfill the purposes defined in this Privacy Notice and may also be required by law. Thus, it may not be possible to remove such personal data.

• You have the right to object to the processing operations that are based on legitimate interest. You always have the right to object to processing for marketing purposes and decline from receiving future direct marketing.

• When processing of your personal data is based on your consent, you have the right to withdraw such consent at any time. The withdrawal will not affect the lawfulness of the processing carried out before the withdrawal.

• You have the right to receive the personal data you provided in a structured, commonly used machine-readable format and transmit such data to another data controller. Please note that this right applies only to the personal data you have provided, is processed by automated means and where the processing is based on your consent or a contract.

• If you believe there is a problem with the way we are handling your personal data, you have a right to file a complaint to your national data protection authority in the EU/EEA, for instance the Finnish Data Protection Ombudsman (www.tietosuoja.fi). You may also file a complaint to the data protection authority in any other EU member state where you live, work, or where you think the alleged violation has occurred. However, we ask that you reach out to us first to allow us to address your concerns.

FOR CALIFORNIA RESIDENTS

Last updated [XX] December 2022

This section applies only to residents of California and is meant to provide additional information about how we handle personal information about California residents as required under California privacy laws including the California Consumer Privacy Act (“CCPA”).

Categories of personal information

The categories of personal information we have collected in the preceding 12 months, and the sources of such information are described in the section “What data do we collect?” above.

Purposes for collecting your personal information

Depending on the Services you have used, we use your personal information for the following business purposes:

• Auditing related to an interaction with you and concurrent transactions including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions.

• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

• Debugging to identify and repair errors that impair existing intended functionality in our Services.

• Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

• Performing Services including, but not limited to, maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

• Internal research for technological development and demonstration.

• Activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Disclosures to third parties

We do not “sell” your personal information to third parties. As described in the “Do we share your personal data?”, depending on the Services you have used, we share your personal information with a variety of recipients, such as our service providers, to achieve our business purposes.

In the preceding 12 months, we have disclosed the following categories of personal data as part of our Services:

Your rights

The CCPA grants you certain rights and you can submit your requests by either using the support feature in our Services or to contact us in the address mentioned in section “How to contact us?” above.

Please note that when you submit a request, we may take certain steps to validate your request by asking you some questions (e.g. about game experience, such as your current level or your playerID) and matching the information provided by you with the information we have in our records.

• Right to know. You have the right to request that we disclose certain details to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we will disclose to you (i) the categories of personal information we have collected about you; (ii) The categories of sources from which we have collected personal information about you; (iii) Our business or commercial purposes for collecting that personal information; (iv) The categories of third parties with whom we share that personal information; (v) The categories of personal information that we have disclosed about you for a business purpose; and (vi) a copy of the specific personal information we have collected about you.

• Right to deletion. You have the right to request that we delete personal information we have about you. Upon receiving your verifiable request, we will delete your personal information and direct our service providers to do so, unless we have a lawful right to retain your information under the CCPA. For example, we may deny your request if retaining your personal information is necessary for detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activities or to comply with a legal obligation.

• Right to non-discrimination. We will not discriminate against you for exercising any of your rights granted in the CCPA. Unless permitted by the CCPA, we will not deny your use of our Services or provide you with a different level or quality of Services.

Adherence to IAB Transparency and Consent Framework

Metacore Games participates in the IAB Europe Transparency & Consent Framework and complies with its specifications and policies. Metacore Games uses the consent management platform with the identification number 300.

Changes to this notice

We reserve the right to amend this Privacy Notice at our discretion and at any time. We may update this Privacy Notice due to changes in our operations or in the processing of personal information. The date this Privacy Notice was last updated is identified at the top of this page. You are responsible for periodically visiting the Websites and this Privacy Notice to check for any changes.