Privacy Policy

Version date: February 25th, 2026

Issue Date: 25/02/2026

Effective Date: 25/02/2026

NOTE: We may translate this Privacy Policy into other languages. If there is any difference between the English version and other language versions, then the English version, subject to applicable laws and regulations, shall prevail.

Welcome to Gorilla Games and thanks for playing our games!

We recognise and value the privacy of people who use our services (“you” or “user”). This privacy policy describes the different ways we may collect, use and share information on, through, or in connection with our services. In this policy, “Gorilla Games” refers to GORILLA ENTERTAINMENT PTE. LTD. (a company registered in Singapore at #10-04, Royal Group Building, 3 Phillip Street) and its affiliates, which shall mean any entity that directly or indirectly controls, is controlled by, or is under common control with GORILLA ENTERTAINMENT PTE. LTD. We may also refer to Gorilla Games as “we” or “us”. If you have any questions, please reach out to us as described in “Contact Us” below.

What are our services?

We use the term “our services” to collectively describe any of the products or services such as website, game, player community on mobile devices, tablets, personal computers and other devices and offline activities that directly link to this privacy policy. These include, for example:

Please read this entire privacy policy. You should also carefully review any other agreements that apply to the services you use, and confirm you understand and agree to them, before using those services.

By accessing our websites or otherwise using our services, you acknowledge that you have read, understood, and accepted this Privacy Policy. In the case that you do not agree with any of the terms of this Privacy Policy, you may immediately stop using our services. We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Services or other appropriate means.

This Privacy Policy informs you of the following information:

  1. What Data We Collect and Process

  2. Why We Collect and Process Your Personal Data

  3. Legal Basis of our Data Collection and Processing

  4. Information Sharing

  5. Data Security and Retention

  6. Your Rights and Choices

  7. Children’s Protection

  8. Changes to Privacy Policy

  9. Contact Us

  10. Supplemental Terms – Jurisdiction-Specific

  1. WHAT DATA WE COLLECT AND PROCESS

Personal data means any information relating to an identified or identifiable natural person The types of Personal data we collect and process are as follows:

A. Data We Collect and Process (either directly from users or through a third party)

i. Contact Information and Identifiers / Account Registration Information. When you create an account, we collect your username, email address, mobile phone number, password, verification code, Open ID/Union ID and data you voluntarily elect to provide in order to customize game play, to help you create and manage the account for your use of our services, to provide game login services, and for other purposes set forth in Section 2 of this Privacy Policy.

ii. Service Account Information. We also collect account information related to our services, such as your nickname, avatar, gender, username, account ID and account level.

iii. Date of birth. Where applicable, you may need to provide us your date of birth for age verification or screening purposes and / or your birthday when you apply for birthday gifts or other benefits available on our services.

iv. Connected Social Media Account Information (Third Party). If you choose to log in to our services via your social media account(s), we will receive your social media account information (including your username, nickname or social media user ID) from third party social media providers (such as Facebook, X, Google Play, Game Center). Such information obtained from third party social media providers will be added to your account information.

v. Personal Profile Information. In some of our services, you have the option to create a personal profile. If you choose to do so, we will collect the information you fill in and post to your profile. This may include, depending on the setup of the services: a nickname, personal signature, avatar, social media platform account details, number of followers, links to your work, number of likes, Discord Username, type of creator, game character ID, and other relevant information you provide to us.

vi. Game Data. We process information about in-game services and functions, including your gameplay status, progress, and usage statistics to provide you with feedback and information, and for other purposes set forth in Section 2 of this Privacy Policy.

vii. Chat Data. If you use the chat function that is available in some of our services (e.g. the in-game chat), we process your communications.

viii. Community Forum Information. You have the option to use our community forum service. If you choose to use our community forum service, we will collect content, communications that you provide when you use our community forum service. This includes content that you create or share, or that you communicate with others, as well as information contained in or related to such content (for example, metadata like the date on which a file was created). It also includes content that you view or use through the features we provide, such as taking photos, uploading photos, or uploading other content (where applicable).

ix. User Generated Content.  We process all content generated by users, including information that you post on our services (if any), all feedback you provide to us, information that you post, comment, or follow in any of our content or services.

x. User Service Information. When you seek our technical and/or customer service support and/or exercise any of your legal rights as the data subject, we collect the information that you provide in communications with our support team.

xi. Survey Information. We will collect your survey responses, if you participate in our surveys.

xii. Activity Participation Information. If you agree to participate in any activities organized by us (such as sweepstakes), we collect your participation information including your name, UID, email address, mobile phone number, nickname, country/region. Where you win any prizes, you may also need to provide us your mailing address or certain tax information for us to send you the prize. Your activity participation information may be added to your account.

xiii. Internet Protocol (IP) Address and Device Data. We may collect data about the platform and device on which your account is used, such as the type of operating system (e.g., iOS / Android/ Harmony), device name/model and your IP address.

xiv. Advertising Information. For the purpose of providing personalized advertisements, you acknowledge and agree that we collect and process your data, including but not limited to advertising ID (including Google Advertising ID, IDFA), Device ID (including IDFV, OAID, Android ID) and other select device information, and store this information with your profile to deliver, target and improve our advertising; and/or improve advertising and other marketing and promotional activities. Additionally, after taking appropriate technical security measures to de-identify or pseudonymise your email address (including email address collected from third party social media providers when you log in via your social media account(s)), we may use your de-identified or pseudonymized email address to track the success of our advertising and marketing programs. We, or where allowed under applicable law, our authorized contractors may deliver advertisements, marketing or promotional communications.

Pertaining to the advertisements, marketing or promotional communications, if you do not wish to receive such information, you may be able to opt-out of receiving such communications in accordance with the instructions contained in the communication, such as email, online communication channels, or other contact methods provided by us.

xv. Payment data. If you choose to make purchase(s) with your account, we need to collect your payment data and purchase history in order to maintain your transaction history record and process your purchase(s) and related activity, which include your name, the data concerning transaction date, transaction order number, currency, cost, payment channel, and product(s) purchased.

xvi. Third-Party Payment Channels. Our services support various third-party payment channels to facilitate your transactions. These include, but are not limited to, payment cards (such as credit or debit cards) from different countries and regions, electronic wallets, and other virtual payment instruments. Specific options will be displayed as selectable payment methods where available within the service for your convenience in completing current and subsequent payments.

xvii. Inferences.  We make certain inferences, such as your preferences and interests, drawn from any of the information we collect.

B. Data We Automatically Collect

i. Device-related data. This includes data such as online ID, Advertising ID and/or device ID, device name, device type/model, MAC address, browser type, IP address, IMEI data, CPU data, OS version and language, time zone, screen DPI, device resolution, device mode/status, device and browser settings and configurations, memory data, and graphics card model.

ii. Cookies data and similar technologies. In order to measure the effectiveness of our services, we may use cookies, which are small text files and similar tracking technologies for added functionality or for tracking site usage. We may, and/or authorize a third-party’s tracking-utility use cookies, web beacons and similar technologies, from time to time, to: (a) remembering you: to help us identify you as a registered user and keep the preferences or data that you have previously provided; (b) analyzing how you use our services: to help us understand what visitors (including users) are doing on our services, or what pages or sections are most popular, and to tell if you have opened or acted upon our email messages or newsletters; (c) deliver advertising: to help us provide you with advertising that we believe is relevant to you or of interest to you, on the basis of the data you provide; and/or (d) prevent fraud and fulfil other purposes mentioned in Section 2. Please note that most web browsers automatically accept cookies, but if you do not wish to accept cookies or want to be notified of when they are placed, you may set your web browser to do so, if your browser permits. In that case, some aspects of the service may then not function properly.

iii. Data related to bugs, errors, crashes and diagnosis. This includes registration/login time, game version, UID, stack trace, crash reports, and abnormal process data.

iv. Security related data. This includes installed app names, system startup time, app install and update time, request and referral URLs, and system activity details, game-related plug-in and runtime data, network status and information, and data related to external plugin programs.

v. Services interaction and/or usage data. This includes the pages and other content you view, the URL of the website from which you came to our sites, any content you post, the dates and times of your visits, the types of content you search for, view, or interact with, the features you use, the actions you take, the people or accounts you interact with, and when, how often, and for how long.

vi. Information about your interactions with others. We also capture and use the content, communications, and information you provide when you interact with others as a fan or contact.

vii. Data shared with us by third parties. This includes (i) data we receive from third-party applications when you link them to our services, such as when you make a third-party login via Facebook, X, Google, or Apple, and (ii) third-party data for message push, security assurance, and statistical analysis purposes.

In order to better provide you with a complete gaming experience, we may merge our collected personal data with data from third-party contractors in order to update your profile (e.g. the information of your connected third-party accounts), perform market analysis, and/or otherwise as set forth in Section 2 of this Privacy Policy, with your prior consent or where we have other legal grounds permissible under applicable laws.

When you use or interact with third-party services that may be available on our services, such as third-party social media widgets, share buttons, and/or login mechanisms, this Privacy Policy does not and will not extend to such services/features, which will be subject to the respective third-party privacy policies.

C. Sources of Personal Data  

We have collected personal data from different sources and in various ways, including the following categories of sources:

  1. WHY WE COLLECT AND PROCESS YOUR PERSONAL DATA

In order to provide our services to you, we collect and process your personal data for one or multiple purposes described below, including:

i. facilitate your use and access to, or to restrict your use or access to, our services;

ii. allow you to create accounts that enable you to manage your account and personal profile;

iii. facilitate our age verification process;

iv. facilitate your download of our games including any related troubleshooting;

v. provide you the services required by you and perform our contractual obligations with you;

vi. analyze and manage our services for system administration, user service, security, fraud-detection, checking the authenticity of an account owner, archival and/or backup purposes;

vii. correct bugs or errors, improve our services and respond to customer desires and preferences, including language and location customization, personalized support and instructions, and other responses;

viii. develop new services or products and improve the user experience;

ix. verify and confirm payment, ensure payment security, maintain transaction history record and resolving subsequent payment disputes;

x. deliver advertising that may be relevant to your interests and track the success of our advertising and marketing programs;

xi. communicate with users (including by sending text messages and/or push notifications) and take action against violations;

xii. personalize your experience;

xiii. provide you with customer service support;

xiv. create contact with other users of our services;

xv. facilitate your participation in creator events;

xvi. keep you up to date with the latest product announcements, and provide other information pertaining to our services;

xvii. provide software verification, upgrades and administration, notify of special events;

xviii. participate in our surveys, events or activities;

xix. prevent malicious content information in order to ensure a harmonious and healthy online environment in our services;

xx. to prevent certain words in your signature (if applicable), nickname, or chat data from offending or distressing others within our services;

xxi. ensure security and stable operations;

xxii. provide a fair gaming environment, including prevent cheating;

xxiii. improve the functionality and quality of our services;

xxiv. fulfill our obligations under applicable laws and regulations, respond to requests of government authorities;

xxv. establish, exercise, or defend legal claims;

xxvi. analyze, profile, segment, merge and/or update all collected data (regardless of an aggregated or individualized manner) for the purposes of improving service quality and providing a better experience;

xxvii. protect the integrity, information safety, and financial security of our services or users, comply with legal obligations, and enforce compliance with the Terms of Service or other restrictions placed on your use of our services;

xxviii. track your process across our websites and applications to verify that you are not a bot and to optimize our services; and/or

For the purposes mentioned above, our affiliates may be commissioned to process your information, provided that such affiliates comply with the terms in this Privacy Policy.

  1. LEGAL BASIS OF OUR DATA COLLECTION AND PROCESSING

We are required to disclose the legal basis for processing your data under EU General Data Protection Regulation (“GDPR”). To the extent that such laws apply to you, we rely on the following legal bases to collect and process your personal data:

i. Necessary for us to comply with our service agreement.

ii. Conducted with your consent, especially when legally required.

iii. Necessary for us to carry out our legally stipulated obligations.

iv. Necessary for us to protect your important rights and the important rights of others (unless there is a conflict of interest between these rights and your rights).

v. Necessary for our legitimate interests and those of third parties, including our rights to provide innovative, direct marketing, and secure services to our users.

  1. INFORMATION SHARING

Generally, we will not share your personal information with third parties. We may share your information with our affiliates for the purposes indicated in Section 2 of this Policy. In addition, we may share your information with other parties in the following situations.

If we share your personal information with the third parties, we will take measures such as encryption to ensure the security of your information. For the companies and organizations with which we share personal information, we will conduct a reasonable review of their data security environment and require third parties to take sufficient protective measures for your information and strictly comply with applicable laws and regulations and regulatory requirements.

A. Other In-Game Users and Community Forum Users of Our Services

Other users may, for example, in a group challenge, access your in-game activities in the process of such group challenge.

Other users may be able to see data you display or read information in posts created by you through our community forum service(s). You acknowledge and agree that if you use our services which may include message boards, communities, forums, and/or other chat areas, where users may exchange ideas or communicate with each other, any data you post there is publicly viewable. We strongly recommend that all users avoid posting sensitive data at any time on or through our services.

It is important to note that when you choose to share content on public social media platforms, or you access these third parties product services through our services' portals, the information you share on these platforms becomes public and accessible to a wider audience. Please exercise caution and ensure that you have read and agree to the privacy policy presented by the relevant third platforms and that the content you choose to share is consistent with your privacy preferences. This Privacy Policy does not, and will not, extend to such features that are subject to the respective third party's privacy policies.

People who can see your activity on our community forum service(s) have the option to share it with others in and outside of our products. For example, when you publish or share a post, other users can download, screenshot, or forward it to others within and outside of our products, or share such content on other social networks such as Facebook and X.

B. Competent Authorities

We may provide your personal data to governmental authorities as so requested according to applicable laws and regulations, or where it is in the public interest to do so.

Other than where we are required by applicable laws and regulations, we reserve the right to disclose your personal data in the cases if we, in our good faith, believe that disclosing such data is necessary to identify, contact, or bring legal action against you, if we reasonably believe that (a) you are violating any other agreement(s) between you and us, such as the Terms of Service, this Privacy Policy, or otherwise damage us; (b) you are infringing third-parties’ rights and interests (including but not limited to intellectual property rights); and/or (c) it is necessary to prevent fraud or other illegal activities.

C. Merger, Acquisition, Reorganization, Bankruptcy, New Owner

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, we will make an announcement in advance, disclose the details of the event and information about the successor, and transfer your personal data to our successor entity in accordance with applicable laws. In addition, where permitted by applicable laws, we may transfer your personal data to third parties on the basis of our legitimate interests in connection with a corporate transaction: (i) in the event that we sell or buy any business or assets, in which case we may disclose only such personal data as is necessary to the prospective seller or buyer for the purposes of evaluating or completing such transaction; or (ii) if we or substantially all of our assets are acquired by a third party, in which case personal data held by us will be one of the transferred assets. Any such transfer will not affect your rights under applicable data protection laws.

D. Service Providers

We may work with the following types of third party service providers to help us provide services and functionalities to you. For details regarding the specific categories of information that may be shared with each type of service provider, please refer to Appendix A.

i. Social networking portals (who may be considered our partners in some countries) who provide login and/or content-sharing service to and in our services;

ii. Logistics service providers who provide shipping services such as delivering physical prizes to users;

iii. Information communication service providers who provide SMS-messaging services;

iv. Payment service providers who provide payment services, such as assisting us in operating services, facilitating users’ payment, and maintaining a record of the users’ transaction history;

v. Advertising and Analytics service contractors who provide marketing and advertising activities, including showing you ads that we think may interest you, conducting the programs, tracking the success, and analyzing the effect thereof;

Please be aware that advertisers or websites with links to and/or from our websites may collect personal data about you. This Privacy Policy does not apply to such third party services, and cannot control the activities of, those other advertisers or websites. We highly recommend that you read the privacy policy of such third-party websites which you may be directed to before providing any personal data.

vi. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us; and

vii. Other contractors, if any, for the purpose of providing our services to you such as cloud hosting, content delivery, customer and technical support, content moderation, marketing, analytics. We may share your information with these service providers as necessary to enable them to provide their services.

Additionally, such service providers may use cookies, web beacons, and/or other tracking technologies to collect or receive data about you. Users purchasing and/or subscribing to products or services will be required to provide additional data to third-party payment service providers, such as a valid credit card number and its expiration date. Such third-party payment service providers may collect, process, and retain your data to process payments and resolve subsequent payment disputes and inquiries. We also receive, process and store the provided information from you and/or such third-party payment service providers to confirm payment, record purchase history, and/or protect our legitimate interest when resolving subsequent payment disputes and inquiries.

Notwithstanding the foregoing, for some of our services, if you make any payments in using these services, your payment details are fully handled by the relevant payment service provider, and we do not receive and/or process any of your actual payment details such as card number or security code. In these cases, we only keep the data concerning transaction date, currency, cost, and product(s) purchased.

E. Business Partners

Third Party Game Developers and Operators. We may operate games developed and licensed by third party game developers, or license some of our games to other operators. In either case, we may share your data with such third party game developers and operators to ensure the continuous development and operation of our games or the third party games.

Our services occasionally runs collaborations and special events with our business partners. These events may be run locally or globally, online or offline. If you participate in these special events, your personal data may be shared with these business partners in order to carry out the event, delivery of any prizes, to follow up on any events which you had opted in for, etc.

When specific third parties are involved in collecting data and information, please refer directly to their privacy policies on their official websites and learn more about their data processing practices.

F. Affiliates

As a global company, the Services are supported by certain entities within our Affiliates Entities. These entities may process your information, as necessary to provide certain functions, such as storage, content delivery, security, research and development, analytics, customer and technical support, and content moderation.

G. Third parties designated by you

We may share your personal information with third parties where you have instructed us or provided your consent to do so. For example, we may share your personal information with third-parties with whom we are collaborating to offer you additional services that you have requested or chosen to use. We will share only the personal data that is necessary for these other companies to provide the services that you have requested.

5. DATA SECURITY AND RETENTION

A. Data Security

We endeavour to take reasonable measures to prevent unauthorized access to or improper use of your personal data, such as organizational controls, technical protection, and other protection measures.

Unfortunately, the transmission of information via the internet is not completely secure. While we strive to protect your personal data, we also remind you to be aware of hacking, cyber-attacks, and other risks on the Internet.

Therefore, we strongly recommend you to take all possible precaution to protect your personal data when using our services, including but not limited to changing your passwords from time to time, using a combination of letters and numbers when creating passwords, using a secure browser and/or taking other possible security measures.

B. Data Retention

We will keep your data only for as long as your account is active or only for as needed to provide you the game services unless deleted in accordance with your explicit request or where we are required to do so under applicable law. Your personal data will be stored on our servers located in Frankfurt, Germany. As a general principle, your personal data is processed and stored locally within the European Economic Area (“EEA”) and is not transferred outside the EEA.

Where it is necessary to transfer your personal data to a country or region outside the EEA, we will do so only after obtaining your explicit consent, where required, and in accordance with applicable data protection laws, including the requirements set out under the GDPR.

Where necessary for the purposes mentioned in Section 2 of this policy, we may transfer your personal data to other parties, including those in Section 4 of this policy, which may involve the cross border transfer of data to other countries. In doing so, we will ensure that your personal data receives the appropriate level of protection in compliance with the applicable laws and regulations.

In the case you request to remove or delete your personal data, please note that we will continue to retain your data as long as necessary for applicable laws and regulations, such as to comply with our legal obligations, resolve disputes, and/or enforce the agreements between you and us. Please note that the removal or deletion of any of your data may result in the termination of some of our applicable services.

Where required by law, we will only store your information as long as necessary to fulfil the purposes for which the information is collected and processed unless a longer retention period is required or permitted by applicable laws and regulations. Upon the expiration of such period, your personal data will be deleted, blocked or anonymized, or, where deletion is not possible, securely restrict its processing, in accordance with applicable laws and regulations.

6. YOUR RIGHTS AND CHOICES

Subject to the applicable laws and regulations, you may have the following data protection rights as a user of our services and to withdraw your consent.

To exercise any applicable rights below or to exercise any other statutory data subject rights you may enjoy under applicable laws and regulations, you may contact us using the contact details under the “Contact Us” heading below.

To protect the security of your account and your personal data, we may ask you to provide certain additional information before we respond to your requests. Under some circumstances, we may refuse to comply with your request as permitted by applicable laws and regulations. We may also charge a reasonable fee for complying with your request in accordance with applicable law (e.g. if your request is clearly repetitive or excessive).

(1) Right of Access to Your Personal Data

You have the right to access your personal data that we hold about you, such as (i) the purposes of the processing; (ii) the categories of personal data concerned; (iii) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (iv) where possible, the criteria used to determine the envisaged period for which the personal data will be stored; (v) the right to lodge a complaint with a supervisory authority; (vi) where the personal data are not collected from the data subject, any available information as to their source; (vii) the existence of automated decision-making, as well as the significance and the envisaged consequences of such processing for the data subject.

Where we process your personal data, you have the right to request a copy of such personal data. For any additional copies requested, we may charge a reasonable fee based on administrative costs, as permitted under applicable data protection laws.

To exercise your right of access or any other data subject rights under the GDPR, please contact us at survivorace_surpport@gorillajoy.com. We will respond to your request without undue delay and in any event within one month of receipt of your request.

Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, in which case we will inform you of the extension and the reasons for it within the initial one-month period.

(2) Right to Rectification

You have the right to request the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data, including by means of providing a supplementary statement.

To exercise your right to rectification or any other data subject rights under the GDPR, please contact us at survivorace_surpport@gorillajoy.com. We will respond to your request without undue delay and in any event within one month of receipt of your request.

Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, in which case we will inform you of the extension and the reasons for it within the initial one-month period.

(3) Right to Erasure

You have the right to request the erasure of your personal data in accordance with Article 17 of the GDPR, where the relevant legal grounds are met. You may exercise your right to erasure through any of the following means:

(i) By contacting us via email
You may submit a request for erasure by contacting us at survivorace_surpport@gorillajoy.com. We will respond to your request without undue delay according to GDPR.

(ii) By deleting your game account
You may request the erasure of your personal data by voluntarily deleting your game account through the in-game account management functions. Upon completion of the account deletion process, we will erase or anonymise your personal data, unless retention is required by applicable laws or regulatory obligations.

(iii) By withdrawing your consent
Where the processing of your personal data is based on your consent, you may withdraw such consent at any time. Upon withdrawal of consent, we will erase the personal data processed on the basis of such consent, unless another legal basis applies or retention is required by applicable laws.

You acknowledge and agree that as a result of deleting your account, maybe you would lose access to game-related services, including the account information, subscriptions and game-related information linked to such account, and lose the possibility to access other services through the account.

(4) Right to Restriction of Processing

You shall have the right to obtain from us restriction of processing where one of the following applies: (i) the accuracy of the personal data is contested by the data subject, for a period enabling us to verify the accuracy of the personal data; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (iii) We no longer need the personal data for the purposes of the processing, but we are required by you for the establishment, exercise or defence of legal claims; (iv) you have objected to processing pursuant to Article 21(1) of GDPR pending the verification whether our legitimate grounds override yours. You may contact us at survivorace_surpport@gorillajoy.com to submit the requirement. We will respond to your request without undue delay according to GDPR.

(5) Right to Data Portability

You shall have the right to receive the personal data which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller where the processing is carried out by automated means.

The exercise of the right shall be without prejudice to the Right to Data Portability. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. The right shall not adversely affect the rights and freedoms of others. You may contact us at survivorace_surpport@gorillajoy.com to submit the requirement. We will respond to your request without undue delay according to GDPR.

(6) Right to Object and Automated Individual Decision-making

(i) Right to Object

You shall have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where such processing is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in us, or on our legitimate interests or those of a third party, including profiling based on such processing.

We shall no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing by contacting us at survivorace_surpport@gorillajoy.com, which includes profiling to the extent that it is related to such direct marketing.

If we have collected and processed your personal data based on your consent, you can withdraw your consent in accordance with applicable laws. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. In many circumstances, we need to use your personal data in order for us to provide you with our services which you require. If you do not provide us with the required personal data, or if you withdraw your consent to our use and/or disclosure of your personal data for these purposes, it may not be possible for us to continue to serve you or provide you with the services that you require.

You may be able to refuse or disable Cookies by adjusting your browser settings. Because each browser is different, please consult the instructions provided by your browser. Please note that you may need to take additional steps to refuse or disable certain types of Cookies. For example, due to differences in how browsers and mobile apps function, you may need to take different steps to opt out of Cookies used for personalized advertising in a browser and to opt out of personalized advertising for a mobile application, which you may control through your device settings or mobile app permissions. In addition, your opt-out selection is specific to the particular browser or device that you are using when you opt out, so you may need to opt-out separately for each browser or device. If you choose to refuse, disable, or delete Cookies, some of the functionality of the Services may no longer be available to you.

(ii) Not Subject to Automated Individual Decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, in accordance with Article 22 of the GDPR.

This right shall not apply where the decision:
(i) is necessary for entering into, or for the performance of, a contract between you and us;
(ii) is authorised by applicable law to which we are subject and which also lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
(iii) is based on your explicit consent.

7. CHILDREN’S PROTECTION

We believe that it is the responsibility of parents or guardians to supervise their children’s use of our services. Our Services are not directed to children under the age of 13, or such higher minimum age as may be required by applicable laws in your jurisdiction, and we do not knowingly collect or solicit personal data from children below this age. If you are a parent or legal guardian and believe that we may have inadvertently collected personal data from a child below the applicable minimum age, please contact us at survivorace_surpport@gorillajoy.com. Upon verification, we will take reasonable steps to promptly delete or stop processing such personal data.

8. CHANGES TO PRIVACY POLICY

We may occasionally update this Privacy Policy including to align with changes in our services or processes or comply with updated laws and regulations. We encourage you to check this Privacy Policy for updates periodically. Where necessary or required under law, we will notify you of any updated terms to obtain your consent again or allow you to exercise your rights. If you have any questions or concerns about our privacy practices, please reach out to us using the details provided in the "Contact Us" section below.

Your continued use of our services shows that you acknowledge how we will collect, handle, and use your personal data according to the revised Privacy Policy.

9. CONTACT US

If you have any requests, concerns, questions about us, this Privacy Policy or how we process your personal data, or you want to make any complaints or want to exercise your data subject rights, please contact us as soon as possible by emailing our Data Protection Office at survivorace_surpport@gorillajoy.com, or via the address below:

Company name: GORILLA ENTERTAINMENT PTE. LTD.

Address: #10-04, Royal Group Building, 3 Phillip Street, Singapore

10. SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

(1) Additional Information for US Residents

Data Retention

Where your data is required to be deleted in accordance with your request or where we are legally required to do so under applicable law or otherwise, we may retain certain personal information where permitted or required under law. For example, we may retain persistent identifiers such as device ID, device FP, IP address and other device information that was collected prior to obtaining verifiable parental consent, for the purpose of supporting internal operations.

Your Rights and Choices

Right to Opt-out of Targeted Advertising and Data “Sales”

Some privacy laws define “sale” broadly to include some of the data disclosures described in Section 4 above – in particular certain sharing with third party providers for targeted advertising purposes. To opt-out from targeted advertising and any related data “sales,” you have several options. You can use browser or device-level controls as follows:

· Cookie controls. Please note that if you choose to refuse or delete cookies, this could affect certain features, settings and preferences controlled by those cookies including advertising preferences which may be deleted and may need to be recreated.

· Do Not Track. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the websites you visit indicating you do not wish to be tracked. Our websites do not respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the advertising controls described above.

· Mobile advertising ID controls. iOS, Android and Harmony operating systems may provide options to limit tracking and/or reset the advertising IDs.

· Email web beacon controls. Most email clients have settings that allow you to prevent the automatic downloading of images, including web beacons, and the automatic connection to the web servers that host those images.

These choices are specific to the device or browser you are using. If you access our services from other devices or browsers, take these actions from those devices or browsers to ensure your choices apply to the data collected when you use them.

Additional terms for California Residents

California Consumer Privacy Act (“CCPA”). The CCPA requires us to provide our users who reside in California with the additional notice below. For the purposes of this notice, Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or as otherwise defined by the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time.

Personal Information does not include information that is:

· Lawfully made available from government records.

· Deidentified or aggregated.

· Otherwise excluded from the scope of the CCPA.

We collect and disclose the categories of personal information as set out in Section 1 above, for the business purposes set out in Section 2.

If you are a California resident, and the processing of personal information about you is subject to the CCPA, you have certain rights with respect to that information:

· Notice at Collection. At or before the time of collection, you have a right to receive notice of our practices, including the categories of personal information and sensitive personal information to be collected Section 1, the purposes for which such information is collected or used Section 2, whether such information is sold or shared, and how long such information is retained Section 5. You can find those details in this Privacy Policy by referring to this and the above-referenced sections.

· Right to Know. The right to request a copy of the personal information that we have collected about you in the prior 12 months. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information. Note that we have provided much of this information in this Privacy Policy. You may make such a “request to know” as described in Section 6 of this Privacy Policy.

· Rights to Request Correction or Deletion. You also have rights to request that we correct inaccurate personal information and that we delete personal information under certain circumstances, subject to a number of exceptions. To make a request to correct or delete, please email us using the contact information in Section 9 of this Privacy Policy.

· Right to Opt-Out / “Do Not Sell or Share My Personal Information”. You have a right to opt-out from future “sales” or “sharing” of personal information as those terms are defined by the CCPA.

Note that the CCPA defines “sell,” “share,” and “personal information” very broadly, and some of our data disclosures described in this Privacy Policy may be considered a “sale” or “sharing” under those definitions. In particular, we let advertising and analytics providers collect identifiers (IP addresses, cookie IDs, and mobile IDs), activity data (browsing, clicks, app usage), and device data through our sites and apps when you use our online services, but do not “sell” or “share” any other types of personal information. If you do not wish for us or our partners to “sell” or “share” personal information relating to your visits to our sites for advertising purposes, you can make your request by emailing us using the contact information in Section 9 of this Privacy Policy. If you opt-out using these choices, we will not disclose or make available such personal information in ways that are considered a “sale” or “sharing” under the CCPA. However, we will continue to make available to our partners (acting as our service providers) some personal information to help us perform advertising-related functions. Further, using these choices will not opt you out of the use of previously “sold” or “shared” personal information or stop all interest-based advertising.

· Right to Limit Use and Disclosure of Sensitive Personal Information. You have a right to limit our use of sensitive personal information for any purposes other than to provide the services or goods you request or as otherwise permitted by law. Note that we do not use sensitive personal information for any such additional purposes.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

Further, to provide, correct, or delete specific pieces of personal information we will need to verify your identity to the degree of certainty required by law. We will verify your request through common market practices, including by asking you to send it from the email address associated with your account or requiring you to provide information necessary to verify your account.

You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

Additionally, under California Civil Code section 1798.83, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes.

California Customers may request further information about our compliance with this law by emailing the address provided in the “Contact Us” section above. Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code section 22581 to remove, or request and obtain removal of, content or information they have publicly posted. To remove content or information you have publicly posted, or to request that we remove such content or information, please send us a detailed description of the specific content or information you wish to have removed using the details provided in the “Contact Us” section above. Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

An authorized agent may submit an access or deletion request on your behalf by sending a written authorization signed by you using the contact information in the “Contact Us” section. We may still require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.

(2) Additional Information for Residents of Japan

If you are located in Japan, please see the information below with regard to international data transfers as described in Section 75(Data Security and Retention), in accordance with Article 28(2) of the Japanese Act on the Protection of Personal Information.

(a) the name of the countries where the data recipients are located (headquartered)

Singapore

(b) the personal information protection systems of such foreign countries

See the link below: https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku

(c) the measures to be taken by the data recipients

We will ensure that third parties in foreign countries to which we transfer your personal data take all measures corresponding to the applicable regulations.

(3) Additional Information for residents of South Korea

If you are in South Korea, the following additional information applies to you in addition to the Privacy Policy set out above.

Destruction of Your Personal Data

If we determine that your personal data is no longer needed, we will destroy it in accordance with applicable law and the Privacy Policy. Personal data in the form of electronic files will be securely deleted using technical methods to prevent recovery and reproduction, and printouts will be destroyed by shredding or incineration.

Data Subjects Rights

In addition to the information set out in the "Your rights and choices" section in the Privacy Policy above, you may have the right to request the suspension of processing of your personal data that we have collected and processed. However, such a request may be denied under applicable laws or regulations.

In many circumstances, we need to process your personal data in order to provide you with the services you require. If you do not provide the necessary personal data, or if you request the suspension of its processing for these purposes, we may be unable to continue providing you with the services you require.

Appendix A

Third-Party Service Provider Information That May Be Shared
Social Networking Portals Account ID, nickname, profile picture (if the user chooses to log in via a third-party account).
Logistics Service Providers Recipient's name, delivery address, contact phone number. (This occurs only when a user participates in an activity and requires delivery of a physical prize.)
Information Communication Service Providers User's mobile phone number and necessary SMS content (e.g., verification codes or notification messages).
Payment Service Providers Order number, transaction amount, currency, transaction time, purchased product information, payment status, and other transaction-related data. (Sensitive payment information such as full bank card numbers, verification codes, and security codes are collected and processed directly by the third-party payment service provider. We do not directly receive or process such information.)
Advertising & Analytics Service Contractors Device identifiers, IP address, advertising ID, usage behavior data, ad interaction data, etc. (In principle, this does not include directly identifiable personal information (such as name, phone number, or email address).)
Professional Advisors Information related to compliance, auditing, dispute resolution, or finance, such as account information, transaction records, or necessary user data. The specific scope depends on the purpose of the professional service and sharing occurs only when necessary.
Other Contractors Account ID, basic account information, usage logs, customer service communication content, or technical operation-related data. The specific information shared depends on the type of service provided by the contractor.