XD PRODUCTIONS PRIVACY POLICY

Effective as of: September 15, 2019

This Privacy Policy will help you understand what information we collect, how we use it and what choices you have when you play any of our games, use our websites, buy merchandise from us, or take part in live events and promotions (the "Services").

Please note that in addition to the general information below, specific information about how certain of our Services use your information is provided at the end of this Privacy Policy in the "Mobile Game Specific Disclosures" (9).

1. Who decides how your information is used?

XD Productions is the data controller responsible for making decisions about how we use your personal information:
If you have any questions or comments on this policy, you can email us: contact@xdprod.com

2. The information we collect about you and how we use it

This Privacy Policy covers our use of any information that can or could be used to identify you ("Personal Data"). It does not cover information which cannot be used to identify you ("Anonymous Data").
We need to collect and use certain Personal Data to provide the Services:

• When you sign up for our Services you give us Personal Data voluntarily by providing it to us. We collect and use that information in order for you to receive the Services, and so that you receive the correct version of the Services. That information includes the in-game Team Name you choose to use.

• We also collect and use your in-game actions and achievements, as well as certain information about your mobile device (including device identifiers, device OS, model, configuration, settings and information about third party applications or software installed on your device), to operate the Services for you and to ensure that we provide a fair gaming experience to all players in accordance with our Terms of Service (which includes anti-fraud and anti-cheating measures against behaviors prohibited under our Terms of Service).

• We further use the information above in order to provide technical and customer support to you.

• You also give us Personal Data when you make a purchase through us, subscribe to our publications, register for a live event, enter a competition, promotion, sweepstakes or survey or communicate with us. Depending on which of these Services you use, that may include your name, mailing address, phone number, country of residency, date of birth (as needed to verify eligibility), and email address. We use that information to fulfil those Services to you and to provide related customer support to you. In addition, we have and rely on a legitimate interest in using your Personal Data as follows:

• Using your IP address, browser type, operating system, the web page you were visiting before accessing our Services, the pages of our Services which you browsed or the features you used, and the time spent on those pages or features, the links on our Services that you click on, device and advertising identifiers, as well as actions you take during gameplay, your in-game user settings and preferences and your in-app purchases to understand who is using our Services and how.

• Using your contact information, namely your email address in order to communicate with you to provide technical and customer support.

• Using your email address and device information in order to share updates and news about the Services with you either within the games or by email. You can unsubscribe from these at any time in your device settings or in-app settings.

• To offer new or additional features for our Services.

• To organize and run live events based on or featuring our games. Note that when you participate in live events your in-game actions and achievements, in-game username and your team, and other components of your in-game profile will be visible to other event participants and to the public (for example on leaderboards displayed at the event and online).

• To make legal or regulatory disclosures. We will only use your Personal Data to do the following if we have your consent:

• Send you marketing materials by email or via in-app notifications. You can unsubscribe from these at any time in your device settings or in-app settings.
We also rely on your consent where we use cookies or similar technologies. Please see our Cookie Policy for more information about how we use them. Insofar as cookies collect Personal Data, we will process it only based on your explicit consent, in anonymized form, or under a pseudonym.
While you may disable the usage of cookies through your browser settings, XD Productions currently does not respond to a "Do Not Track" signal in the HTTP header from your browser or mobile application due to the lack of industry standard on how to interpret that signal.

3. Who we share information with

We will not share any Personal Data that we have collected from or regarding you except as described below: Information Shared with Our Services Providers. We engage third party service providers to work with us to administer and provide the Services. As part of that they will process your Personal Data on our behalf. These third-party service providers have access to your Personal Data only for the purpose of performing services on our behalf, in compliance with this Privacy Policy, and we make sure each one is contractually obliged not to disclose or use your Personal Data for any other purpose. The service providers we use help us to:

• run, operate and maintain our mobile games through third party platform and software tools;

• perform content moderation and crash analytics;

• run email and mobile messaging campaigns;

• perform game and marketing analytics;

• administer live events, competitions and promotions, including registering players, managing check-in and attendance, verifying eligibility and prize fulfilment;

• provide technical and customer support; and

• process payments for live events ticketing or other purchases. Some third-party service providers may also collect information directly from you (for example, a payment processor may request your billing and financial information) as a Third-Party Service in accordance with their own privacy policy. Such third-party service provider does not share your financial information, like credit card number, with XD Productions, but it may share limited information with us related to your purchase, like your zip or postal code. Information Shared with Third Parties. We share Anonymous Data with third parties for industry and market analysis. We may share Personal Data with our third-party publishing partners for their direct marketing purposes only if we have your express permission. We do not share Personal Data with any other third parties for their direct marketing purposes.
Information Disclosed for Our Protection and the Protection of Others. We cooperate with government and law enforcement officials or private parties to enforce and comply with the law. We only share information about you to government or law enforcement officials or private parties when we reasonably believe necessary or appropriate: (a) to respond to claims, legal process (including subpoenas and warrants); (b) to protect our property, rights, and safety and the property, rights, and safety of a third party or the public in general; and (c) to investigate and stop any activity that we consider illegal, unethical, or legally actionable.
Information Disclosed in Connection with Business Transactions. Information that we collect from our users, including Personal Data, is a business asset. If we are acquired by a third party as a result of a transaction such as a merger, acquisition, or asset sale or if our assets are acquired by a third party in the event we go out of business or enter bankruptcy, some or all of our assets, including your Personal Data, will be disclosed or transferred to a third party acquirer in connection with the transaction.

4. How your Personal Data is transferred

XD Productions Services are accessible around the globe. Your Personal Data will very likely be transferred and stored in a country outside of your home country, including in the USA, for the purposes outlined in this Privacy Policy. The data protection laws in these countries may not be the same as in your home country.
If we transfer your Personal Data from the EEA to other countries, including the USA, we ensure that a similar degree of protection is provided to your Personal Data as within the EEA by ensuring that at least one of the following safeguards is implemented:

• The country that your Personal Data is transferred to is a country that the European Commission has deemed to provide an adequate level of protection for Personal Data as the EEA.

• We use specific contracts approved by the European Commission which give Personal Data the same protection as it has in Europe when we engage with service providers.

• Where we engage with service providers in the USA, they are part of the EU-US Privacy Shield, which requires them to provide the same protection of your Personal Data as it has in the EEA.

5. How we keep your Personal Data safe

We have appropriate security measures in place to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorized way, improperly altered or disclosed. We also limit access to your Personal Data to employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

6. How long we will keep your Personal Data

We keep your Personal Data for as long as we need to provide the Services to you and fulfil the purposes set out in this Privacy Policy. This is also the case for anyone that we share your information with and who carry out services on our behalf.
When we no longer need to use your Personal Data and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either remove it from our systems or anonymize it so that it can no longer be associated with you. When removing Personal Data, we will take commercially reasonable and technically feasible measures to make said Personal Data irrecoverable or irreproducible.

7. Your rights and choices

You have certain rights in relation to your Personal Data. In order to exercise these rights, please contact us at: contact@xdprod.com. You can:

• Request access to the Personal Data we hold on you.

• Delete or correct your Personal Data. The easiest way to update your account information is via your in-app settings. You can also submit a customer support request through our support website here.

• Object to us processing your Personal Data. Some of the Personal Data we hold is necessary for us to provide the Services to you and fulfill the promises we make to you in the Terms of Service.

• Ask us to stop using your Personal Data, including for marketing and promotional purposes (but be aware that sometimes we need to use your Personal Data in order for you to use the Services).

• Have your Personal Data transferred to another organization (where it is technically feasible).

• Complain to a regulator. We'd appreciate the chance to deal with your concerns directly so we'd prefer you to contact us first. You can complain to our regulator:
CNIL (Commission Nationale de l’informatique et libertes) to the following address: 3 place de Fontenoy – TSA 80715 – 75334 Cedex 07, France We offer you choices regarding the collection, use, and sharing of your Personal Data and we’ll respect the choices you make. Please note that if you decide not to provide us with the Personal Data that we request, you may not be able to access all of the features of the Services.
We aim to provide the information or complete the outcome you request within 35 days.

8. Children

Unless stated otherwise for a particular Service, children are not allowed to use the Services, and we do not collect Personal Data from them. We define "children" as follows:

• Residents of the EEA: anyone under 16 years old, or the age needed to consent to the processing of personal data in your country of residence.

• Residents of the Republic of Korea, anyone under 14 years old.

• Residents of other regions: anyone under 13 years old
XD Productions Services contains information on the age requirement for each of our Apps. For Services that permit Child participation, parents or legal guardians ("Parents") must provide verified consent. Where Parental consent is required, XD Productions recommends that Parents monitor the Child’s online activity and use of the Services. XD Productions’ Services are in full compliance with the U.S. Children's Online Privacy and Protection Act (COPPA) and the E.U. General Data Protection Regulation (GDPR)

Verifiable parental consent is required for the collection, use, or disclosure of a child's Personal Data. XD Productions will not collect, use, or disclose any Personal Data from a child if their parent or guardian does not provide such consent.
If we learn that we have collected Personal Data of a child, and we do not have parental consent, we will take steps to delete such information from our files as soon as possible.

9. Mobile Apps Specific Disclosures

Additional Privacy Information for ARTreasure Hunt and ARQuest mobile applications. Following the United States regulations of the Children’s Online Privacy Protection Rule (COOPA), XD Productions does not collect any of listed information below from children:

• First and last name;

• A home or other physical address including street name and name of a city or town;

• Online contact information;

• A screen or user name that functions as online contact information;

• A telephone number;

• A social security number;

• A persistent identifier that can be used to recognize a user over time and across different websites or online services;

• A photograph, video, or audio file, where such file contains a child’s image or voice;

• Geolocation information sufficient to identify street name and name of a city or town; or

• Information concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described above.

10. Cookies Policy

Our websites ("Services") use cookies, which are small text files that are placed on your computer or device by a Web server when you access our Services. We may place and access cookies and similar technologies on your computer or device, which are known as "first party cookies". Cookies may also be placed and accessed by third parties, which are known as "third party cookies" and are described below.

We use cookies and local storage to monitor aggregate usage and web traffic of our Services, customise and improve our Services, help you navigate our Services, deliver content specific to your interests and deliver advertisements to you.

We also use "web beacons" (also known as web bugs, pixel tags, or clear GIFS) which are small graphics with a unique identifier that may be included on our Services for example to deliver or communicate with cookies, to track and measure the performance of our Services, to monitor how many visitors view our Services, and to monitor the effectiveness of our advertising. Unlike cookies, which are stored on a user's hard drive or device, web beacons are typically embedded invisibly on web pages (or in an email).

We use the following types of cookies:

Strictly Necessary Cookies: These are cookies that are essential to enable you to use the Services, for example moving around our websites and using their features.

Performance Cookies: These are cookies which collect information about how and when you and other visitors interact with our Services (e.g. pages viewed most often) and the information collected by these cookies is used to improve how our Services work.

The types of cookies described above may be "session cookies" or "persistent cookies". Session cookies are only stored on your device whilst you are using the Services, and are deleted when you close your browser. Persistent cookies remain on your device for a period of time after you log off from the Services or close your browser.

Third Party Cookies

Some cookies may be placed by third parties when you use the Services as some third party service providers that we engage (including third party advertisers) may place their own cookies on your hard drive or device. These cookies may provide information to those third parties about your browsing habits or may be used for security. Some also help to serve you with advertisements which are more relevant to you.

For example, our websites use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses non-operational cookies, which are text files placed on your computer to help the website analyse how visitors use the website. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. At our request, Google will use this information for the purpose of evaluating how the website is used, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

Similarly, we use the Facebook pixel service. The Facebook pixel is an analytics tool that allows us to measure the effectiveness of our advertising by understanding the actions you take on other websites. We use it to make sure our advertising on Facebook is shown to the right people and is effective. When you visit our websites and take an action, this triggers the pixel which reports this action to Facebook.

By using our websites, you consent to the processing of data about you by Google and Facebook in the manner and for the purposes set out above.

Cookies Placed by Third Parties When You Visit Third Party Websites or Service

Cookies Settings

You may decline cookies that are not Strictly Necessary by clicking “Decline” in the cookie banner on your screen. Additionally, although most browsers automatically accept cookies, you can change your browser options to stop automatically accepting cookies or to prompt you before accepting cookies. However, if you don’t accept cookies, you may not be able to access all portions or features of the Services.

If you continue to use the Services, you consent to our use of cookies as described in this Cookies Policy.

11. Changes to this Privacy Policy

Any Personal Data that we collect is covered by the Privacy Policy in effect at the time such information is collected. We may make changes to this Privacy Policy from time to time. You will be given reasonable notice of any material change.

12. Third Parties

In using our Services, you may access links to websites and services that are owned or operated by third parties (each, a "Third Party Service"). Any information that you provide on or to a Third-Party Service or that is collected by a Third-Party Service is provided directly to the owner or operator of the Third Party Service and is subject to the owner’s or operator’s privacy policy. We’re not responsible for the content, privacy, or security practices and policies of any Third-Party Service. To protect your information, we recommend that you carefully review the privacy policies of all Third-Party Service that you access.