PRIVACY POLICY

Last updated: June 2026

BASIC INFORMATION ABOUT DATA PROTECTION

Tangelo Games Spain SLU, located at Calle Amigó nº 11, primera planta 08021 Barcelona, holder of Tax Identification Number ES65596744 (the “Data Controller") hereby informs you of its privacy policy (the "Privacy Policy") regarding the processing and protection of the personal data of users and customers (the "Users" and/or "Customers") which may be collected through browsing or User contact via the website, platform and games (the "Platform").

In this regard, the Data Controller guarantees compliance with current legislation on the protection of personal data, set out in Organic Act 3/2018 of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD) and with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (GDPR).

• DATA CONTROLLER: Tangelo Games Spain SLU, located at Calle Amigó nº 11, primera planta 08021 Barcelona, holder of Tax Identification Number ES65596744 or the Data Controller.

• PURPOSE: The handling of requests of various kinds by the User, to be precise, to provide the services of the Platform and the management and execution of payments of prizes obtained by the User.

• LEGITIMACY: Consent and/or Contract.

• RECIPIENTS: Your data may be communicated to service providers acting as Data Processors, required for the provision of the Platform's services.
  To be precise: (i) Veriff OÜ: for the verification of your identity (KYC) and, (ii) PayRetailers: for processing payment transactions in Latin America and the management of bank transfers for the payment of prizes.

• RIGHTS: Access, Rectification, Opposition, Erasure, Limitation of Processing and Portability of Personal Data.

If you do not agree with our Privacy Policy, please do not access or use any of our services, nor interact with us. In any case, you can always exercise your rights under this Privacy Policy.

This document will help you understand:

1. Who are we?

2. Our principles

3. What information do we collect? For what purpose we process your personal data. The legal basis on which we process your data

4. If we assign or pass on your data to third parties

5. How we store and secure said information

6. How long we store your data for

7. Your rights

8. Privacy policy updates

This Privacy Policy covers the information we collect from you when you communicate and interact with us, browse or use our Platform (see the Cookie Policy if you would like to know more about this last aspect).

WHO ARE WE?

The data controller of your personal data is: Tangelo Games Spain SLU, an Spanish company whose registered office is located at Calle Amigó nº 11, primera planta 08021 Barcelona, holder of Tax Identification Number: ES65596744

OUR PRINCIPLES

With regard to the processing of your personal data, the Data Controller shall apply the following principles which are in accordance with the GDPR:

• Principle of lawfulness, fairness and transparency: the Data Controller will always require consent for the processing of your personal data, which may be for one or more specific purposes about which you will be informed in advance with absolute transparency.

• Data minimisation principle: the Data Controller will request from you only those data strictly necessary for the stated purpose or purposes.

• Storage limitation principle: data shall be kept for the time strictly necessary for the purpose(s) of processing.
  The Data Controller will inform you of the relevant retention period depending on the purpose. As far as subscriptions are concerned, the Data Controller will periodically review the lists and remove those registrations that have been inactive for a considerable period of time.

• Principle of integrity and confidentiality: your data will be processed in such a way that their security, confidentiality and integrity are guaranteed. You should be aware that the Data Controller takes the necessary precautions to prevent unauthorised access or misuse of its users' data by third parties.

WHAT INFORMATION DO WE COLLECT ABOUT YOU? PURPOSE OF PROCESSING AND LEGAL BASIS

When you access the Platform or contract (signing up to and/or using the services offered on the Platform), you are providing personal information for which the Data Controller is responsible. This information may include personal data such as your name, e-mail address and phone number and other information, if any. By providing this information, you consent to your information being collected, used, managed and stored by the Data Controller.

The data obtained are the following:

• name (or nickname),

• e-mail

• phone.

• Postal code

• National identification number or similar (this only applies in some cases in Latin America)

• In addition, where the User becomes entitled to receive a prize or financial compensation through the Platform, the Controller will collect and process the following categories of financial data: bank account number (IBAN), bank identification code (SWIFT/BIC), and the full name of the account holder.
  The sole purpose of this processing is the administrative management and technical execution of the payment of such prizes. The legal basis for this processing is the performance of the contractual relationship entered into by the User through participation in the Platform, in accordance with Article 6(1)(b) of the GDPR. These data will be processed under strict security measures, including encryption at rest and restricted access controls, and will be deleted once the transaction has been duly completed and the applicable statutory limitation periods for legal liabilities have expired.

What's more, in cases where it is necessary to verify your identity, we will collect and process additional data such as your identity card, passport or other official document, as well as a selfie, through our identity verification provider, Veriff OÜ.

In addition, for the management of payment operations in certain regions, such as the American continent, it may be necessary for you to provide your national identification number (e.g., CPF, DNI, inter alia) at the time of making the transaction on our payment page.

This information is an essential requirement requested by our payment service provider for LATAM, PayRetailers, in order to process and validate the transaction securely, as well as to comply with the fraud prevention and risk regulations applicable in said region.

It is important to note that this data will not be stored by either the Data Subject or the payment service provider once the transaction validation is complete.

There are other purposes for which the Data Controller processes your personal data:

• To ensure compliance with the conditions set out in the Terms and Conditions and applicable law. This may include the development of tools and algorithms to help this Platform ensure the confidentiality of the personal data it collects. Should this be the case, the legal basis for processing is compliance with a legal obligation.

• To support and improve the services offered by this Platform. Should this be the case, the legal basis for the processing is the consent to this Privacy Policy.

• To manage the Data Controller's presence on social media. If you become a Data Controller's follower on social media, the processing of personal data will be governed by this section, as well as by said terms of use, privacy policies and access regulations that pertain to the social media applicable in each case and which you have previously accepted. Should this be the case, the legal basis for the processing is the consent to this Privacy Policy.

• For statistical purposes. The legal basis is the consent to this Privacy Policy.

Under no circumstances will the Data Controller use the profiles of followers on social media to send advertising on an individual basis. In any case, advertising will be sent after obtaining your specific consent thereunto.

TRANSFER AND COMMUNICATION OF DATA TO THIRD PARTIES

The Data Controller will not transfer your personal data to third parties, except in cases where there is a legal or judicial obligation. However, for the proper provision of services, we use third-party providers who will act as Data Processors.

These providers will only access your personal data to fulfil the specific purposes for which they have been contracted, always acting under our instructions and having formalised a data processing agreement that guarantees compliance with applicable regulations.

The main data processors are:

• Veriff OÜ: It acts as the Data Processor to carry out the identity and age verification processes (KYC).

In the event that Veriff OÜ carries out international data transfers, these will be carried out with the appropriate safeguards required by the GDPR, formalised through the Standard Contractual Clauses (SCCs) approved by the European Commission and the implementation of the relevant technical and organisational measures. Respect for the rights of the Data Subject and due attention to his/her requests is guaranteed at all times.

• PayRetailers: It acts as a Data Processor in its dual capacity as: (i) a payment service provider for the processing of transactions carried out in Latin America; and (ii) a payment manager for the execution of bank transfers relating to the payment of prizes to Users.

For the latter purpose, PayRetailers will have access to the IBAN, SWIFT/BIC code, and the full name of the account holder provided by the User. In accordance with the services agreement, PayRetailers will process personal data solely for the purpose of providing payment processing services, including fraud prevention, anti-money laundering measures, transaction monitoring, and compliance with applicable regulatory obligations.

For these purposes, PayRetailers may engage its affiliated entities or other local partners (Subprocessors), provided that they are subject to the same data protection safeguards and obligations.

Under no circumstances will the aforementioned data processors use your data for their own purposes.

Any sub-processing by our processors will require our prior written authorisation, ensuring that the sub-processors are subject to the same data protection obligations as the main processor.

HOW WE STORE AND SECURE INFORMATION.

We implement effective technical and organisational security measures designed to protect your data and information. However, no security system is impenetrable, and owing to the inherent nature of the Internet we cannot guarantee that your information available in our servers and for service providers will be secure from intrusion by third parties.

RETENTION OF YOUR DATA

The personal data provided will be kept for the time necessary to fulfil the purpose for which they are collected, as well as to determine any possible liabilities that may arise from the purpose, in addition to the periods established in the files and documentation regulations.

YOUR RIGHTS

You may exercise your rights of access, rectification, erasure and portability of your data, limitation and opposition to their processing, as well as not to be subject to decisions based solely on the automated processing of your data, by contacting our DPO (Data Protection Officer) at the following e-mail address dpd@tangelogames.com, specifically indicating which right or rights you wish to exercise. You may also exercise these rights before the Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001- Madrid, or at the e-mail address dpd@aepd.es.

In order to comply with the principles of information and transparency, basic information on the rights provided for by the GDPR has been briefly detailed below:

PRIVACY POLICY UPDATES

We may change this Privacy Policy from time to time to reflect new services, changes in our personal data practices or changes in applicable laws. The "Last update" title at the top of this Privacy Policy indicates when it was last revised. All changes will take effect when we post the revised Privacy Policy. We may provide you with information and alerts regarding the Privacy Policy or personal data collected via postings on our Platform and, if you are a Customer, via an e-mail.

---

COOKIE POLICY

1. INTRODUCTION

This website (hereinafter, the "Platform") uses first-party and third-party cookies to improve the user experience and provide content tailored to their interests, through the personalisation of advertising spaces. When he/she signs up to the Platform and/or once the User has accepted said cookies, which he/she may revoke at any time (hereinafter, "Cookie Policy").

Our Cookie Policy is subject to periodic updates. Its purpose is to help you understand how we use cookies, the purpose of the cookies used, as well as the options available to the user to manage them.

Users may access this information at any time via the link provided at the website. You can also change your preferences regarding the acceptance of cookies through your browser options.

When you visit our Platform for the first time, we will show you a pop-up window with an explanation of the cookies, where you can accept, deny or configure said cookies. As soon as you click "Configure" and select your preferences or "Accept all", you consent to our use of the categories of cookies and plug-ins you have selected in the pop-up window, as described in this Cookie Policy.

2. WHAT ARE COOKIES?

Websites may collect data about you, use data storage and retrieval devices ("cookies"), embed additional tracking code from third parties, and monitor your interaction using this code.

In order for this Platform to function properly, it needs to use cookies called "essential cookies" as well as other types of cookies to complement the latter and offer a better service on the Platform, constituting information that is stored on your web browser. These cookies will be used when the User has given prior consent to do so, in accordance with that indicated in the pop-up window of the User's browser when accessing the Platform for the first time.

A cookie is a file that is downloaded to your computer when you access certain web pages. Cookies allow a website, amongst other things, to store and recover information about the browsing habits of a user or its equipment and, depending on the information they contain and the way in which he uses his equipment, they may be used to recognise the user. The user's browser memorises cookies on the hard drive solely during the current sessions, occupying a minimum amount of memory and not damaging the computer. Cookies do not contain any kind of specific personal information and the majority of them are deleted from the hard drive when the browser session ends (the so-called session cookies).

The majority of browsers accept cookies as standard and, regardless of the latter, they allow or prevent temporary or memorised cookies in the security settings.

3. WHAT TYPES OF COOKIES DOES THIS WEBSITE USE?

Strictly necessary Cookies: Some cookies are essential for you to experience the full functionality of our site. They allow us to maintain user sessions and prevent any security threats. They do not collect or store any personal information. For example, these cookies allow you to log in to your account and add products to your cart and checkout securely.

Analytical Cookies: These cookies store information such as the number of visitors to the Platform, the number of unique visitors, which pages of the Platform have been visited, the source of the visit etc. These data help us to understand and analyse how well the Platform is working and where it needs improvement.

Marketing/tracking cookies: Our Platform displays advertisements. These cookies are used to personalise the adverts we show you so that they are relevant to you. These cookies also help us to track the effectiveness of these advertising campaigns. Third-party advertising providers may also use the information stored in these cookies to show you advertisements at other Websites on your browser.

Functional Cookies: These are cookies that support certain non-essential functionalities at our website. These functionalities include embedding content such as videos or sharing website content on social media platforms.

Preference Cookies: These cookies help us to store your browsing settings and preferences, such as language preferences, so that you have a better and more efficient experience on future visits to the Platform.

The following list details the cookies used at our website:

4. YOUR RIGHTS REGARDING PERSONAL DATA

• You have the right to know why your personal data are needed, i.e. their purpose, as well as what will happen to them and how long they will be kept for.

• Right of access: You have the right to access the personal data we hold about you.

• Right to rectification: You have the right to supplement, correct, erase or block your personal data at any time.

• If you consent us the processing of your data, you are entitled to revoke this consent and to have your personal data deleted.

• Right to transfer your data: You have the right to request all your personal data from the controller and to transfer them in their entirety to another data controller.

• Right to object: You may object to the processing of your data.

To learn more about your rights and to exercise them, please see our Privacy Policy.

5. CONTACT DATA

If you have any questions and/or comments about our Cookie Policy and this statement or would like to exercise any of your data protection rights, please contact our DPO (Data Protection Officer) using the following contact details at this e-mail address: dpd@tangelogames.com

6. HOW TO DISABLE COOKIES

You can use your internet browser to delete cookies automatically or manually. You can also specify for certain cookies not to be permitted. Another option is to set your Internet browser settings so that you will be notified each time the placement of a cookie is permitted. For further information about these options, please refer to the instructions in your browser settings.

Please note that our Platform may not work properly if all cookies are disabled. Finally, if you delete cookies on your browser, but consent again when you log on to our Platform, Cookies will be permitted again and will be installed based on your new consent.