Privacy Policy Welcome to BANDAI NAMCO Entertainment Europe! BANDAI NAMCO is a société par actions simplifiée (French simplified joint stock company), with a share capital of €50,000,000.00, registered with the Trade and Companies Registry of Lyon, under number 487 663 320, with registered offices located at 49-51 rue des Docks 69258 Lyon Cedex 09. Siret Number: 487 663 320 00033. BANDAI NAMCO Entertainment Europe, and its subsidiaries and affiliates (collectively, "BANDAI NAMCO") respect the privacy rights of its online visitors and its players and unreservedly acknowledges the importance of protecting all the information you share with us. To meet this commitment, we have adopted this online Privacy Policy ("Privacy Policy"). By using BANDAI NAMCO's websites, games and online services, which are all subject to this Privacy Policy (collectively, "Products and Services"), you acknowledge our right to collect, store, use and disclose your personal information as defined in this Privacy Policy. Please note that privacy policy provisions may vary between countries. Please ensure that the flag at the top right is the flag of your country of residence. If the flag displayed is not the flag of your country of residence, BANDAI NAMCO cannot be held liable for any act contrary to the laws in force in your country. TABLE OF CONTENTS 1 Why has BANDAI NAMCO implemented this policy? 2 What information is covered by this Privacy Policy? 3 What about information collected from children? 4 How does BANDAI NAMCO collect personal data? 5 How do cookies work? 6 How does BANDAI NAMCO use my information? 7 Whom does BANDAI NAMCO share my information with? 8 Can third parties collect information from BANDAI NAMCO's Products and Services? 9 How long does BANDAI NAMCO keep my personal information? 10 What security measures does BANDAI NAMCO take to ensure the confidentiality of my personal data? 11 How can I update or change my login information and profile? 12 What are my rights? 13 Why is your data communicated to us? 14 The existence of automated decision-making 15 How can I ask questions or send comments about this Privacy Policy? 16 How are updates to this Privacy Policy communicated? Question 1 Why has BANDAI NAMCO implemented this policy? BANDAI NAMCO is committed to offering games that customers all over the world can trust and makes every effort to ensure that everyone can fully enjoy them. We do whatever we can to earn your trust in our products and online practices to ensure we respect our commitments. To prove the importance we attach to the confidentiality of your information, we have implemented this Privacy Policy, which explains – in clear and plain language – how we collect, store, use and share the information you provide. BANDAI NAMCO processes personal data concerning you as a controller in the context of the use of its website accessible via the following address: https://www.bandainamcoent.eu, and when you play BANDAI NAMCO games. It respects privacy and protects the personal data of users of the services it offers. The Data Protection Officer is Ms. Nathalie Plouviet (Esq.) from the Alain Bensoussan Avocats law firm; her contact details are the following: Maître Nathalie Plouviet, Alain Bensoussan Avocats, Immeuble Cap Etoile, 58 boulevard Gouvion-Saint-Cyr 75017 Paris, France nathalie-plouviet@alain-bensoussan.com +33 (0) 1 82 73 05 05 This Privacy Policy complies with French Act no.78/17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties. Question 2 What information is covered by this Privacy Policy? When you use the BANDAI NAMCO website, several types of personal data may be collected. The personal data we collect through our Products and Services falls under several categories (carefully read the definitions below as the terms are repeated throughout this Privacy Policy): Information you voluntarily provide - Identification data and data for communication purposes such as your name, postal address, email address, telephone number, bank card details (except billing and delivery information), or any other information we can use to personally identify you, or contact you online or by any other means. - All personal data you choose to share (on BANDAI NAMCO's social networks, for example, or as part of user-generated content on websites – see below for details) will be considered as public information for the purposes of this Privacy Policy. - Personal data only contains information collected by BANDAI NAMCO from the Products and Services covered by this Privacy Policy and by no other means. This means that information collected on other websites, on paper documents, etc. is not covered by this Privacy Policy. BANDAI NAMCO is not responsible for the content, activities or information that may be collected by visiting other websites from links on our own websites. - Demographic data, which could contain the following types of information: age, date of birth, education level, sex, products owned/played, favourite games, favourite genres, favourite subjects, favourite characters, and any other non-personal or survey-type information, such as hobbies, preferences, interests and specific skills. This list is not exhaustive. - Login data, such as usernames, passwords, secret answers to certain security questions, or similar information we may use to accurately identify you or your account before authorising you to access account information or certain online activities. Login credentials (e.g. your username) for certain online accounts are sometimes personal (e.g. an email address) or linked to other personal information. Information collected passively or automatically - Technical data, which may include certain information or details about your personal computer, console, mobile device or other peripherals (e.g. operating system, web browser, your IP [Internet Protocol] address, name and version of programs installed on your computer, locale information). Most technical information (such as that described above) remains anonymous and cannot be used to personally identify you, although identification is still possible through certain personal information such as an email address. - Usage data, which may contain non-technical information about: (i) how you use, browse or view content on our websites ("website usage" or "browsing history"), (ii) the products you buy or download online ("order history"), and (iii) your results or progress in certain BANDAI NAMCO games ("game data"). Certain usage information may be associated, linked or able to be cross-referenced with other information in your account, including personal data. Question 3 What about information collected from children? We do not intentionally collect any personal data about minors under the age of 16 without permission from a parent or legal guardian. BANDAI NAMCO is the only legal entity entitled to use the personal information we collect about children. Under no circumstances will this information be sold or transferred to third parties without prior consent from parents or legal representatives. The privacy of children is a priority for us and we encourage parents to take an active and constant interest in their children's online activity. If we find we have inadvertently collected personal data about children under the age of 16 without permission from a parent or legal guardian, we will immediately take all necessary and reasonable measures to delete the information from our systems. Any online user may ask for their personal data to be deleted. We will delete the data as soon as possible, except where laws and regulations impose a different retention period. Question 4 How does BANDAI NAMCO collect personal data? We may collect data from users of our websites or our games when they: - Browse or use our games - Register on our websites - Subscribe to our newsletter - Participate in surveys, polls and questionnaires - Enter contests, games or other promotions - Use e-cards, wish lists and referrals - Register a purchased product - Contact customer or technical support - Access certain website content The legal bases of our data processing We process data only if at least one of the following applies: - you have given consent to the processing of your data; - the existence of our legitimate interest, or that of a third party, which justifies that we process the personal data concerned; - the performance of a contract between you and us requires that we process the personal data concerned; - we are required to comply with legal and regulatory obligations, which require the processing of the personal data concerned. In addition to intentional collection of information, we may use various technologies – including cookies, web beacons and log files – to collect information passively or automatically. Cookies: Cookies are small pieces of data sent by a website to your computer while you are browsing the Internet. Cookies are used (whether by us or other companies) for a variety of reasons. For example, if you go to a website you have visited before, cookies send information to that website so it can "remember" you. You have the option to receive an alert from your computer when a website wants to send you a cookie. You can also block all cookies. The setting for this can be found in your browser (Chrome, Internet Explorer, Safari, Firefox, etc.). Web browsers are all different so we recommend you use your browser's Help menu to find out how to change your cookie settings. If you block all cookies, you may encounter problems with access or features of certain services. To find out more on the content of cookies and know how to exercise your rights relating to cookies, please visit https://www.bandainamcoent.eu/cookies-policy. Web beacons: Web beacons are objects embedded in images on our website pages and in the emails we send to you. We may use web beacons for technical purposes, such as analysing browsing habits, traffic, customer interests and the effectiveness of our marketing initiatives. These technical methods may require information to be sent, either directly to us or to another party we have asked to collect information on our behalf. Log files: Log files are files that record Internet activity and collect non-personal information when you visit or use our websites. Log files help us to record technical data or information on how our websites are used. We may use information in log files (e.g. an IP address along with your personal information) to resolve technical problems, ensure online security and to block or limit certain users' access to our online services, if required. Question 5 How do cookies work? BANDAI NAMCO uses cookies on its website. To find out more on the content of cookies and know how to exercise your rights relating to cookies, please visit https://www.bandainamcoent.eu/cookies-policy. Question 6 How does BANDAI NAMCO use my information? We may use the information (all types combined) we collect about you for various purposes, such as to: - Allow you to use BANDAI NAMCO games - Personalise and enhance your browsing experience and to allow us to offer the type of content and offers that might interest you - Offer and provide products and services, and any solutions required - Send you important messages, such as welcome letters, order confirmations, reminders or any other type of commercial or administrative notice - Create and manage customers' accounts and billing history - Contact you about our products and services, and to tailor our special offers and promotions to your preferences, habits and requirements - Track statistics about our websites and games - Monitor the performance of our customer service employees - Create your online account and recognise you when you try to log in - Quickly process your requests for information - Allow us to respond to your questions efficiently - Organise a contest, promotion, survey or similar - Send you advertising or other promotional material - Allow us to share information about you within the limits provided by law and according to the full terms below. Subscription to the newsletter BY SUBSCRIBING TO THE "NEWSLETTER", YOU EXPRESSLY ACKNOWLEDGE THAT YOU CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SENDING ELECTRONIC MESSAGES. If you withdraw your consent, you will no longer be able to receive the newsletter. Mandatory data is indicated in the collection forms by an asterisk. If you do not provide mandatory data, the service associated with this collection may not be provided. Other collection forms BY FILLING OUT THE OTHER FORMS ON THE WEBSITE, YOU EXPRESSLY ACKNOWLEDGE THAT YOU CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SENDING ELECTRONIC MESSAGES. If you withdraw your consent, BANDAI NAMCO will not be able to answer your questions. Mandatory data is indicated in the collection forms by an asterisk. If you do not provide mandatory data, the service associated with this collection may not be provided. Question 7 Whom does BANDAI NAMCO share my information with? The personal data that we collect, as well as those that will collect subsequently, is intended for us in our capacity as data controller. We ensure that only authorised persons have access to this data. Our service providers can be recipients of this data to perform the services we entrust to them. Some personal data may be sent to third parties or to legally authorised authorities in order to meet our legal, regulatory or contractual obligations. Your personal data may be aligned, combined or shared with all Bandai Namco Group entities. They may be communicated to these entities for purposes set out in these terms of use. These operations are carried out on the basis of instruments that comply with applicable regulations and are capable of ensuring that your rights are protected and respected. BANDAI NAMCO may share your information, including (in some cases) your personal data and login credentials, in the following situations: - When sharing your information with the BANDAI NAMCO family of companies, including its subsidiaries, parent company or international entities. This helps us to better understand who our global customers are, to improve our products around global trends, needs and interests, and to promote our products by using local resources tailored to each geographic region. Personal information of minors under the age of 16 will not be sold or transferred to third parties without prior consent from parents or legal representatives. Personal data may be transferred to the United States. Each of these transfers is carried out on the basis of legal instruments that comply with the applicable legal framework. The recipients of this data have adhered to the Privacy Shield recognised as offering a level of protection equivalent to the one applied on the European Union territory pursuant to the decision on the adequacy of the protection provided by the EU-U.S. Privacy Shield adopted by the European Commission on 12 July 2016. Transfers made to the United States to processors who have not adhered to the Privacy Shield are governed by standard contractual clauses approved by Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council. When sharing your information with our technical service providers and/or subcontractors for proper operation of our websites (product delivery, awarding prizes, payment processing, etc.). We are committed to ensuring these technical service providers and/or subcontractors comply with the terms in this Privacy Policy. If BANDAI NAMCO subcontracts all or part of the processing of personal data to processors, BANDAI NAMCO will require that its processors provide contractual guarantees on the security and confidentiality of personal data by means of technical data protection measures and appropriate human resources. - If BANDAI NAMCO: is bought or acquired – completely or partially – by another company; merges with another company; goes through internal restructuring; is declared bankrupt; or experiences any other similar event, your personal information may be shared with the entity that succeeds us or assumes control of the information (e.g. the new company formed or company taking control), in accordance with the notification procedures specified in the section on changes to this Privacy Policy (see below). - If disclosing this information is required by law or necessary for protecting the security of our websites, we may disclose any information collected, without time limits. We will ensure that any such disclosure remains within the limits permitted by law and within the scope authorised, and we will only do this if we believe in good faith it is necessary for: (i) protecting your security, including the security of your property; (ii) protecting the security of our websites or third-party websites; and/or (iii) enforcing our Terms of Use or rules of a contest, game or special offer. Question 8 Can third parties collect information from BANDAI NAMCO's Products and Services? Can third parties collect information from BANDAI NAMCO's websites? Under no circumstances can a third party collect your information through our websites. However, it is important to note that BANDAI NAMCO's website may contain hyperlinks to websites operated by third parties, including advertisers and other content providers. These websites may collect data or request personal data. In all cases, you are recommended to read the personal data protection policy of each of the websites concerned. BANDAI NAMCO has no control over these third-party websites, nor is it responsible for their content and respective privacy policies, nor any collection, use or disclosure of any information by these websites. In any event, BANDAI NAMCO shall not be held liable in the event that the content of one of these websites infringes the laws and regulations in force. Can third parties collect information from BANDAI NAMCO's mobile apps? When you use BANDAI NAMCO mobile apps, we may ask you to allow certain companies to collect data from BANDAI NAMCO mobile apps so that advertising can be displayed in BANDAI NAMCO mobile apps. In this situation, BANDAI NAMCO is not the data controller. In all cases, you are advised to read the personal data protection policy of each of the companies concerned. BANDAI NAMCO has no control over these companies, nor is it responsible for their content and respective privacy policies, nor any collection, use or disclosure of any information by these companies. In any event, BANDAI NAMCO shall not be held liable in the event that the content of one of these companies infringes the laws and regulations in force. For your information, here are links to the different privacy policies of the companies that collect data from our mobile apps for the purpose of displaying advertising in our mobile apps: https://vungle.com/privacy/ https://www.adcolony.com/privacy-policy/ https://www.ironsrc.com/privacy/ https://chartboost.zendesk.com/hc/en-us/articles/200780269-Privacy-Policy?mobile_site=true https://www.fyber.com/legal/privacy-policy/ https://applovin.com/privacy/ https://www.facebook.com/policy.php https://www.inmobi.com/privacy-policy/ https://unity3d.com/fr/legal/privacy-policy https://deltadna.com/privacy/ https://www.appsflyer.com/fr/privacy-policy/ https://www.appsflyer.com/fr/privacy-policy/ Question 9 How long does BANDAI NAMCO keep my personal information? We keep your personal data according to a retention policy determined so that data is kept for a period proportionate to the purpose for which it was collected, except where laws and regulations impose a different retention period. The retention periods we apply to your personal data are proportionate to the purposes for which they were collected. Our data retention policy is organized as follows: No. Categories of personal data and/or purposes / Rules for active retention 1. User login data for each connection: 6 months from the date of last connection 2. Customer/Player Account Information: 1 year from the date of the account is closed 3. User data for invoicing/delivery/return of orders: Duration of the business relationship from the conclusion of the contract when delivery of the goods or performance of the service is immediate; otherwise from the conclusion of the contract until the date of delivery of the goods or performance of the service 4. Data relating to the user for the purpose of carrying out operations such as game contests: For the duration of the game contest and until the prizes are awarded 5. User data for statistical processing in order to understand uses (improvement of services/products): 13 months maximum 6. User data to enable customer analysis/segmentation: Duration of the business relationship 7. Targeted marketing: 3 years for prospects, from the last contact by the prospect, and the entire duration of the contractual relationship for customers 8. Direct marketing for commercial purposes: 3 years from the last contact by the prospect 9. Email extraction for Facebook/Display campaigns: 3 years from the last contact by the prospect 10. Newsletter unsubscriptions: 6 years for a prospect and the duration of the commercial relationship for a customer, starting from the unsubscription of the newsletter 11. Standard business contact details of B2B partners: Duration of the relationship with the supplier 12. Checking email addresses transmitted via flat files: Duration of the check 13. Marketing campaign: Duration of the email or SMS campaign 14. Better knowledge of the user to propose the relevant advertisements: 3 years from the last contact by the prospect 15. Customer service: Time required to process the customer request 16. User statistics: Duration of the analysis 17. Study of game retention level: Duration of the analysis 18. Targeted advertising for the appropriate age: Duration of the contractual relationship 19. CRM: Duration of the contractual relationship 20. Track identified bugs: Time required to process the incident and no longer than the last six sliding months 21. Cybersecurity: 6 months for login history 22. Managing advertising campaign on clusters: 3 years from the last contact by the prospect 23. Creating content for different websites and social networks: Duration of online content delivery 24. Publication of content on forum: 1 year from the publication of content online In all cases, if you do not respond to any of our requests within 3 years after our last contact, your personal data will be automatically deleted. Question 10 What security measures does BANDAI NAMCO take to ensure the confidentiality of my personal data? BANDAI NAMCO acknowledges that all personal data is subject to compliance with the legal framework applicable to the security of personal data. BANDAI NAMCO undertakes to take the necessary measures to ensure the security of the processing of personal data in compliance with data protection regulations. Maintaining the security and confidentiality of your information is extremely important to us. We have implemented administrative, physical and technical security measures, with regard to the nature of the data we process and the risks of the processing, to preserve the security of the data and, in particular, prevent its alteration and damage, or access by non-authorised third parties. We also carry out periodic reviews of our security procedures with a view to implementing new and updated technologies where appropriate. However, despite the wide range of initiatives and measures in place, no security protocol is perfect, infallible or impenetrable. If BANDAI NAMCO subcontracts all or part of the processing of personal data to processors, BANDAI NAMCO will require that its processors provide contractual guarantees on the security and confidentiality of personal data by means of technical data protection measures and appropriate human resources. You also have a role to play in keeping your personal information safe. If you are asked to create a unique password to secure access to your account, choose one that would be impossible to guess and make sure you never share it with anyone. It is your responsibility to ensure your password and account information is always confidential. If you use a public or shared computer, turn off all settings and options that remember your login credentials and ensure you always log out of your account before leaving the computer. Question 11 How can I update or change my login information and profile? Our websites allow you to access your login details (through the areas called "My Account", "My Profile", "My Settings" or similar names) and we may offer various options for updating your account and personal details within it. If these options are not offered on the website you are visiting, or if the request or change you want to make is not offered in these account management areas, you have several courses of action available to you: - Opting out of BANDAI NAMCO communication and marketing – When registering or sending information, you may be given the option to subscribe to BANDAI NAMCO communication and marketing by ticking the box provided. Some initiatives or registrations may automatically generate certain messages (including marketing communication) when you send personal information (e.g. an email address in a registration form used for this sole purpose) or as part of performing an action that involves receiving messages (e.g. setting up a profile in your BANDAI NAMCO account). Our marketing communications also come with the option to opt out of all future marketing communications of the same type (e.g. option to unsubscribe). You just need to follow the steps to unsubscribe or the instructions contained in the marketing communication. Please note that even if you opt out of all marketing communication from BANDAI NAMCO, you may still receive communication from us, such as product news, account information and mandatory messages. You may also receive messages related to BANDAI NAMCO from friends or family members through their use of referral and sharing features or any other similar website service. - Customer Service – For additional help, please contact Customer Service by phone, post or email using the contact details below. Please note that it is your responsibility to ensure your contact details are accurate and up to date in your BANDAI NAMCO account (including your email address) and to inform us of any change or termination of your email account. BANDAI NAMCO accepts no liability for messages sent to the wrong address (e.g. to an account you no longer use), nor for any personal information shared with a third party as a result of any misdirected message. Question 12 What are my rights? Your right of information You acknowledge that these terms of use provide you with information about the purposes, legal framework, interests, recipients or categories of recipients with whom your personal data is shared, and the possibility of a data transfer to a third country or international organisation. In addition to this information and with the aim of ensuring fair and transparent processing of your data, you further acknowledge that you have received additional information concerning: - the period for which your personal data will be kept; - the existence of the rights which are granted to you and how you can exercise them. If we decide to process data for purposes other than those indicated, all information relating to those new purposes will be communicated to you. Your right of access to and rectification of your data You have the right to access and rectify your personal data, which you can exercise at the following address: https://service.bandainamcoent.eu/ You will obtain confirmation as to whether or not your personal data is being processed and where this is the case, access to your data and the following information: - the purposes of the processing; - the categories of personal data in question; - the recipients or categories of recipient as well as the international organisations to whom the personal data have been or will be disclosed, in particular recipients in third countries; - where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; - the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; - the right to lodge a complaint with a supervisory authority; - where the personal data is not collected from the data subjects, any available information as to its source; - the existence of automated decision-making, including profiling, and in this case, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You can ask us to, as the case may be, rectify or complete personal data that is inaccurate, incomplete, equivocal or expired. Your right to erasure of your data You can ask us to erase your personal data where one of the following grounds applies: - the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; - you withdraw the consent you have previously given; - you object to the processing of your personal data and there is no legal reason for such processing; - the processing of personal data does not comply with the provisions of the applicable laws and regulations; - your personal data has been collected in relation to the offer of information society services to children under 16 years of age. However, the exercise of this right will not be possible when the retention of your personal data is necessary for compliance with laws and regulations and in particular for example for the establishment, exercise or defence of legal claims. Your right to restriction of processing You may request restriction of processing of your personal data in the cases provided for by law and regulations. Your right to object to data processing You have the right to object to the processing of personal data concerning you when the processing is based on the legitimate interest of the controller. Your right to data portability From 25 May 2018, you will have the right to portability of your personal data. The data on which this right can be exercised is: - only your personal data, which excludes anonymised personal data or data that does not concern you; - declarative personal data and personal data relating to our functioning as mentioned above; - personal data that does not adversely affect the rights and freedoms of others such as those protected by trade secrets. This right is limited to processing based on consent or contract as well as to personal data that you have personally generated. This right does not include derived or inferred data, which is personal data created by BANDAI NAMCO. Your right to withdraw your consent When the data processing we carry out is based on your consent, you may withdraw it at any time. We will then stop processing your personal data but this will have no impact on the previous transactions based on the consent you gave before the withdrawal, subject to compliance with the statutory and regulatory obligations which requires data retention to which we are subject. Your right to lodge a complaint with a supervisory authority You have the right to lodge a complaint with the French data protection authority (CNIL) on the French territory without prejudice to any administrative or judicial remedy. Your right to define post-mortem directives You can give instructions in relation to the storage, erasure and communication of your personal data after your death to a certified trusted third party in charge of enforcing the wishes of the deceased in compliance with the applicable legal framework. How to exercise your rights All the rights enumerated above can be exercised by sending a request, together a copy of an ID document, to BANDAI NAMCO Entertainment Europe SAS by post to 49-51, rue des Docks, 69258 Lyon Cedex 09 or https://service.bandainamcoent.eu/. Regarding the exercise of your right of information, we are not required to provide you with information where: - you already possess the information; - the recording or disclosure of your personal data is expressly laid down by law; - the provision of information to you proves to be impossible; - the provision of information to you would involve a disproportionate effort. Question 13 Why is my data communicated to you? Your personal data is communicated to us to be able to enter into the contract allowing you in particular to play our games. As part of that, you are likely to be the subject of direct marketing. In this context, if you refuse to provide us with your personal data, you will not be able to benefit from our online services. Question 14 The existence of automated decision-making When you have agreed to receive direct marketing messages, we inform you that we implement profiling operations in order to target opt-in marketing campaigns, reactivation campaigns and emailing campaigns in relation to your game preferences. These operations, which have no impact on the operation of our services, do not produce legal effects. Question 15 How can I ask questions or send comments about this Privacy Policy? For any questions about this Privacy Policy, contact us by post to the following address: BANDAI NAMCO Entertainment Europe S.A.S. 49, 51 Rue des Docks CS 90618 69258 LYON Cedex 09 FRANCE https://service.bandainamcoent.eu/ Unless specifically requested by you, the personal information sent to the email or postal address above will not be used to send you marketing communication. Question 16 How are updates to this Privacy Policy communicated? This Privacy Policy may be modified or changed at any time. If we make any material changes in how we collect, use or share your personal information, we will publish a clearly visible notice on the website covered by this Privacy Policy advising visitors of the changes made. Any material changes to this Privacy Policy will come into force 30 days after publication of the change notice for this Privacy Policy. Last updated: 25/05/2018.