PRIVACY POLICY

LEGAL INFORMATION

In accordance with the provisions of Law No. 2004-575 of June 21, 2004, on confidence in the digital economy (LCEN), users of the Kickdom website are informed of the identity of the various parties involved in its creation and management. Site publisher: MFF LABS, a simplified joint-stock company (SAS) with share capital of €375,300, registered with the R.C.S. of Pontoise under number 914 784 715, whose registered office is located at 12 Rue des Chauffours, Immeuble Ordinal, 95000 Cergy, France, represented by CHAINVEST SAS, itself represented by JM LABS HOLDING. Intra-community VAT number: FR 87 914784715 Hosting: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States — privacy@vercel.com — https://vercel.com Director of Publication: CHAINVEST SAS Contact: info@kickdom.gg

DEFINITIONS

For the purposes of this Privacy Policy: "Personal Data" means any information relating to an identified or identifiable natural person, as defined by the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the French Data Protection Act of January 6, 1978, as amended. "Service" means the www.kickdom.gg website and all of its content. "Publisher" or "We" means MFF LABS, the legal entity responsible for the publication and content of the Service. "User" or "You" means any individual visiting or using the Service.

ARTICLE 1 — INTRODUCTION

The purpose of this Privacy Policy is to inform you of our commitments regarding the protection of your privacy and the processing of your Personal Data when you use the Service. By registering with the Service, you agree to provide accurate information about yourself. Providing false information is contrary to the general terms and conditions of the Service. This Privacy Policy may be modified or supplemented at any time, in particular to comply with legislative, regulatory, case law, or technological developments. The date of the last update will be clearly indicated. Any changes become binding upon publication. If you have any questions or wish to exercise your rights as described in Article 10, please contact us at info@kickdom.gg, or by post at: MFF LABS, 12 Rue des Chauffours, Immeuble Ordinal, 95000 Cergy, France.

ARTICLE 2 — DATA COLLECTED

The Data collected and processed by the Service is data you voluntarily provide by completing forms on the Service. For certain operations (notably payments), you may transmit Personal Data to third-party partners through their own services. We do not have access to such data. Your IP address is collected automatically. The Service may use cookies and similar tracking technologies, which you may manage as described in Article 12 below. You may generally browse the Service without providing any personal information. We may collect, use, and share aggregated, anonymized data for any purpose. The Service uses Google Analytics for audience measurement. For more information: https://policies.google.com/privacy User contact details are stored in compliance with the GDPR and the French Data Protection Act. Users may exercise their rights by sending a request to info@kickdom.gg, or by post to: MFF LABS, 12 Rue des Chauffours, Immeuble Ordinal, 95000 Cergy, France.

ARTICLE 3 — DATA CONTROLLER

The data controller is MFF LABS, whose registered office is located at: 12 Rue des Chauffours, Immeuble Ordinal, 95000 Cergy, France.

ARTICLE 4 — PURPOSE OF DATA COLLECTION

Data identified as mandatory on the Service's forms is required to access the corresponding features. The Service may collect and process User Data for the following purposes: — To provide the information or services you have subscribed to, including: newsletters, information, promotions, and Kickdom game updates. — To improve our Service, products, and features (notably through cookies). — To contact you regarding information, promotions, and Kickdom game updates.

ARTICLE 5 — RECIPIENTS AND USE

You may receive emails from us, in particular newsletters you have opted into. You may unsubscribe at any time by contacting us at info@kickdom.gg or by clicking the unsubscribe link in each email. Only MFF LABS receives your Personal Data. This data is never sold or marketed to third parties. MFF LABS may use subcontractors, who are bound by strict confidentiality obligations and are not permitted to use your data for their own purposes.

ARTICLE 6 — LEGAL BASIS

In accordance with the GDPR, MFF LABS processes personal data only when at least one of the following legal bases applies: — Your consent (Article 6(1)(a) GDPR) — Performance of a contract to which you are a party (Article 6(1)(b) GDPR) — Compliance with a legal obligation (Article 6(1)(c) GDPR) — Our legitimate interests, provided they do not override your fundamental rights and freedoms (Article 6(1)(f) GDPR)

ARTICLE 7 — DATA SECURITY

We have implemented appropriate technical and organizational security measures to prevent your Personal Data from being accidentally lost, used, modified, disclosed, or accessed without authorization. Access to your Personal Data is restricted to authorized personnel following a defined security procedure. Your Data may be disclosed where required by law, regulation, or a decision of a competent judicial or regulatory authority.

ARTICLE 8 — DATA RETENTION

Personal Data is retained for the period strictly necessary to achieve the purposes described above, which shall not exceed 36 months from the last interaction. Beyond this period, data will be anonymized and kept exclusively for statistical purposes.

ARTICLE 9 — SERVICE PROVIDERS AND EU TRANSFERS

MFF LABS uses authorized service providers to facilitate the collection and processing of your Data. Some of these providers may be located outside the European Union. MFF LABS ensures that all service providers offer adequate guarantees. Transfers to third countries are based on: — An adequacy decision by the European Commission (including the EU-US Data Privacy Framework, adopted July 10, 2023) — Standard Contractual Clauses (SCCs) approved by the European Commission — Binding Corporate Rules (BCRs) approved by a competent supervisory authority

ARTICLE 10 — DATA PROTECTION RIGHTS

In accordance with the GDPR and French data protection law, you have the following rights, exercisable by writing to MFF LABS, 12 Rue des Chauffours, Immeuble Ordinal, 95000 Cergy, France, or by email at info@kickdom.gg: — Right to information: We must inform you of how we use your Personal Data. — Right of access: You may request a copy of the Personal Data we hold about you. — Right of rectification: You may request correction of inaccurate or incomplete data. — Right to erasure ("right to be forgotten"): In certain circumstances, you may request deletion of your Personal Data. — Right to restriction of processing: You may request that we suspend processing of your data. — Right to data portability: You may request a copy of your data in a structured, machine-readable format. — Right to object: You may object to the processing of your data, in particular for direct marketing purposes. — Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Exercising these rights is free of charge. We aim to respond to all legitimate requests within one month.

ARTICLE 11 — COMPLAINTS

If you believe that MFF LABS is not complying with its obligations regarding your Personal Data, you may lodge a complaint with the competent supervisory authority. In France: Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr/fr/plaintes

ARTICLE 12 — COOKIE POLICY

Cookies are small text files stored on your device when you visit the Service. They enable us to recognize your device, improve your browsing experience, and analyze usage. Strictly necessary cookies are essential for the operation of the Service and do not require your consent. They include session cookies, authentication cookies, and load-balancing cookies. Analytics cookies: The Service uses Google Analytics to compile usage statistics. Privacy policy: https://policies.google.com/privacy Third-party cookies: The Service may use social media sharing cookies (Facebook, YouTube, X/Twitter, LinkedIn), governed by the privacy policies of the respective social networks. When you first visit the Service, a cookie consent banner will allow you to accept all cookies, refuse all non-essential cookies, or customize your preferences by category. You may modify your preferences at any time via the cookie settings. Your consent is stored for a maximum of 13 months. Continuing to browse without interacting with the consent banner does not constitute consent. You may also manage cookies through your browser settings: — Chrome: https://support.google.com/chrome/answer/95647 — Edge: https://support.microsoft.com/help/4027947 — Firefox: https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer — Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471

ARTICLE 13 — ADVERTISING IN THE MOBILE APPLICATION

The Kickdom mobile application, available on Google Play and the App Store, displays advertising. This article describes the resulting data processing. It supplements the preceding articles, which cover the website. ADVERTISING PARTNERS Ad delivery is operated by the Unity LevelPlay mediation platform (Unity Technologies), which puts the following ad networks in competition: Google AdMob, Unity Ads, Liftoff Monetize, InMobi, Mintegral, Pangle and AppLovin. Each of these partners acts as an independent controller for the data it collects, and applies its own privacy policy. The full list of partners and their policies is accessible from the consent message shown when the game first launches. DATA PROCESSED FOR ADVERTISING PURPOSES Your device's advertising identifier (Google Advertising ID on Android, Identifier for Advertisers on iOS), which is a pseudonymous identifier you can reset or delete at any time. Technical data: device model, operating system, language, carrier, connection type, truncated IP address. Usage data: ads displayed, ads watched to completion, interactions. Approximate location data, inferred from the IP address at country or region level, never precise geolocation. We do not share your name, your email address, or any directly identifying data with our advertising partners. CONSENT — EUROPEAN ECONOMIC AREA, UNITED KINGDOM, SWITZERLAND If you reside in the European Economic Area, the United Kingdom or Switzerland, a consent message compliant with the GDPR and the ePrivacy Directive is presented to you when the game first launches, through a Google-certified consent management platform. You may accept or refuse, and refusing is as simple as accepting. If you accept, the ads shown may be personalised according to your presumed interests. If you refuse, the game remains fully accessible and you continue to see advertising, but it is non-personalised: it relies solely on the application's content and on contextual data. You may change your choice at any time from the game's privacy settings. Your consent is retained for a maximum of thirteen (13) months, after which you are asked again. APP TRACKING TRANSPARENCY ON iOS On iOS, in accordance with Apple's App Tracking Transparency framework, a separate authorisation is requested before any access to the Identifier for Advertisers. This choice is independent of the consent described above and can be changed in Settings > Privacy & Security > Tracking. The application also uses Apple's SKAdNetwork framework, which allows ad networks to measure campaign effectiveness in an aggregated manner, without individual identification and without access to the advertising identifier. MEASUREMENT AND ATTRIBUTION We use Adjust GmbH (Saarbrücker Straße 37A, 10405 Berlin, Germany) to measure the origin of installs and the use of the game. Adjust acts as a processor on our behalf and processes data according to our instructions. Privacy policy: https://www.adjust.com/terms/privacy-policy/ CONTROLLING YOUR ADVERTISING IDENTIFIER You can reset or delete your advertising identifier directly from your device, independently of any choice made within the game: — Android: Settings > Google > All services > Ads — iOS: Settings > Privacy & Security > Tracking, or Settings > Privacy & Security > Apple Advertising Deleting the advertising identifier does not prevent ads from being displayed, but it prevents them from being personalised. PROTECTION OF MINORS Kickdom is not directed at children and is not declared under Google Play's "Designed for Families" or the App Store's "Kids" categories. We do not knowingly collect data from children under sixteen (16) for advertising purposes. If you believe a child has provided us with such data, please write to info@kickdom.gg and we will delete it. NO SALE OF DATA We do not sell your personal data, within the meaning of the GDPR or of United States consumer privacy legislation. RIGHTS AND COMPLAINTS The rights described in Article 10 and the complaint procedures described in Article 11 apply in full to the processing described in this article. For processing for which a partner ad network is the controller, you may also exercise your rights directly with that network, through its own privacy policy.