Data protection regulations

GENERAL INFORMATION

I. Definitions of terms

Our privacy policy should be easy to read and understand for our website visitors, our users and customers, business partners and interested parties. To ensure this, we would like to explain the most important terms here. In this privacy policy, we use the following terms, among others:

• "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"), e.g. name, address, e-mail addresses, user behavior;
• "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
• "Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
• "Profiling " means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

II Controller

The controller within the meaning of Art. 4 (7) GDPR is

Tales of us gGmbH

Seestr. 35-37

14467 Potsdam

Potsdam, Germany

info@tal esofus.com

For specific questions regarding the processing of your personal data and the exercise of your rights under the GDPR, you can contact the contact points listed above at any time.

PROCESSING OF PERSONAL DATA

The following overview lists all types of data processed by us, the purposes of their processing and the legal basis for their processing.

I. Visiting the website

If you visit our website without transmitting data to us in any other way (e.g. registering as a user), we collect the following data on our web server temporarily and anonymously via server log files

• IP address
• Date and time of the query
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (page visited)
• Access status/HTTP status code
• Amount of data transferred in each case
• Previously visited page
• Browser type
• Operating system used
• Language and version of the browser software
• Host name of the accessing computer.

This processing is technically necessary in order to display our website to you. We also use the data for statistical evaluations to ensure the operational security and stability of our website. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f GDPR.

We also use the data to fulfill our legal obligations for reasons of data security. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. c GDPR.

II Registration

In order to create a user account on our website, we process personal data that you provide during registration. This includes your e-mail address, your user name, your first and last name, your country, your language, the name and type of institution and a password.

The purpose of the requested data is to create a user account for the use of further functions of our services. Registration takes place for the execution or initiation of a user contract, for the provision of customer service, for the administration or answering of inquiries and as a security measure (legal basis: Art. 6 para. 1 sentence 1 lit. b GDPR contract fulfillment and pre-contractual inquiries; Art. 6 sentence 1 lit. f GDPR legitimate interests).

If you have terminated your user account, your data relating to the user account will be deleted, subject to legal permission, obligation or consent on your part. It is your responsibility to save your data in the event of termination before the end of the contract. Subject to any legal permission, obligation or consent on your part, we are entitled to irretrievably delete all data stored during the term of the contract.

III Making contact with us

If you contact us, e.g. by sending us an e-mail or contacting us via a contact form, we will store the contact details you provide, such as your name, address, mobile phone number, e-mail address and the information provided in your inquiry.

If you contact us as part of an existing contractual relationship or to obtain information about our services in advance, we process the data and information you provide for the purpose of processing and responding to your contact request on the legal basis of Art. 6 para. 1 sentence 1 lit. b GDPR. Insofar as you have consented to the processing for the purpose of responding to your inquiry, the legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR. Otherwise, we process your data to protect our legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR for the appropriate response to customer/contact inquiries.

IV. Newsletter

You have the option of subscribing to our newsletter, which we use to keep you up to date about us and our offers. To subscribe, you must enter your e-mail address. When you register, your e-mail address will be transmitted to us (or our e-mail provider) and stored. You will then receive an e-mail to confirm your subscription ("double opt-in").

Our newsletter is sent on the basis of your prior express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You can unsubscribe from the newsletter at any time, either by sending a message to the contact options specified in this privacy policy or via a link contained in the newsletter. After unsubscribing, we will delete your e-mail address from our recipient list, unless you have expressly consented to the further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use your data for other legally permissible purposes specified in this privacy policy.

If we receive your e-mail address in connection with the purchase of a product or service and you have not unsubscribed, we reserve the right to send you offers for similar products or services by e-mail on the basis of Section 7 (3) UWG. This serves to safeguard our legitimate interest in carrying out direct marketing, which is justified after a balancing of interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to this use of your email address at any time by sending a message to the contact options specified in this privacy policy or via a link provided in the marketing email (see also below on your right to object), without incurring any costs other than the transmission costs according to the basic rates.

V. Cookies

We use cookies in some areas of our website. Cookies are small text files that are stored by the browser on your end device (e.g. computer, tablet or cell phone) when you visit a website and can be read by us or a third-party provider. They are used to identify your end device for a certain period of time.

Some of the cookies we use are so-called "session cookies", which are automatically deleted at the end of your visit. Other cookies remain stored on your end device until you delete them. These cookies enable us to recognize your browser on your next visit.

Some cookies are necessary for the use of our website. These cookies are not used for analysis, tracking, advertising or other non-essential purposes. Some of them only contain information about certain settings and are not personalized. These cookies are essential for user guidance, security and the operation of the website. We use these cookies on the basis of Section 25 (2) of the Telecommunications Digital Services Act (TDDDG) to ensure basic website functions.

You can set your browser so that you are informed about the setting of cookies, which makes the use of cookies transparent for you. You can also delete cookies at any time via the corresponding browser setting and prevent the setting of new cookies. Please note, however, that this may result in our website no longer being displayed and some functions no longer being technically available.

In addition, we also use technically unnecessary cookies on the basis of your consent. This processing only takes place with your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can withdraw your consent at any time by sending an email to info@talesofus.com.

For more information on the individual cookies we use on our website, please refer to this privacy policy or our cookie consent banner.

VI Beta game test

When you participate in the beta playtests of our pre-released games ("Beta Playtest"), certain in-game events may trigger the creation of unique tokens or identifiers. For example, a token may be generated when a character customizes their appearance (e.g. by choosing clothing) before interacting with other players. These tokens may be temporarily linked to technical identifiers such as your IP address or device ID to ensure proper session handling and general game functionality.

We process this data solely for the following purposes:

• To enable real-time interactions between players
• To ensure fair and accurate session matching
• To detect and prevent fraud or abuse
• To diagnose game or network problems.

This data is not used to identify you personally and is only stored for as long as is necessary for the particular gaming session, unless longer storage is required for security or troubleshooting purposes.

The legal basis for this data processing is our legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f. 1 sentence 1 lit. f GDPR, namely ensuring the technical functionality, fairness and integrity of the Beta Playtest environment.

VII Tools from third parties

As part of our business operations, we work with service providers who act as processors. This includes functions such as marketing, hosting and website operation. We have entered into Data Processing Agreements (DPAs) with these service providers to ensure compliance with data protection regulations.

Some of these service providers may transfer personal data to third countries outside the EU/EEA. We take appropriate measures to ensure an adequate level of protection. These measures may include:

• EU adequacy decisions: Recognition of countries as sufficiently data protection friendly based on decisions of the European Commission,
• Standard Contractual Clauses (SCCs): Implementation of contractual safeguards approved by the EU,
• Explicit consent: Where required, obtaining your informed consent prior to transfer.

We are committed to handling your data with care and in accordance with all applicable legal and security standards.

We currently use the following third-party tools:

1. Google Analytics

If you have given your consent, our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

This service creates pseudonymized user profiles and uses cookies (see section "Cookies"). The information generated by the cookie about your use of this website (browser type/version, operating system used, time of the server request, referrer URL (the previously visited page), host name of the accessing computer (IP address)) is transmitted to a Google server in the USA and stored there. Google processes the data in the USA.

The data is used to evaluate the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and tailoring the website to user needs. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Your IP address will not be merged with other Google data. The IP addresses are anonymized in order to prevent assignment (IP masking).

The following applies to data transfers to the USA: Google is certified under the EU-US Data Privacy Framework (DPF) and is committed to complying with European data protection principles. In addition, we have concluded EU standard contractual clauses (SCCs) with Google in accordance with Article 46(2)(c) GDPR to ensure compliance with the EU level of data protection.

The use of Google Analytics is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can revoke your consent at any time by clicking on the cookie icon at the bottom of the website and adjusting your settings in the cookie banner that appears.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en.

Further information on data processing by Google can be found here and in Google's privacy policy.

2 Microsoft Azure

For the operation and support of the Beta Playtest, we use the cloud infrastructure and related services provided by Microsoft Azure, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown. Dublin 18, D18 P521, Ireland.

Microsoft Azure is used to host game servers and backend infrastructure. The processing of data by Microsoft Azure may include the temporary transmission and storage of technical identifiers such as IP addresses.

The legal basis for this processing is our legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), namely the provision and maintenance of a secure, stable and effective game testing environment.

VIII Online presence in social media

We have various presences on social media platforms. We operate these sites with the following providers:

• Instagram, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.instagram.com/; Privacy Policy: https: //help.instagram.com/519522125107875
• Twitch, Twitch Interactive, Inc. based in 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA, Website: https://www.twitch.tv/; Privacy Policy: https://legal.twitch.com/en/legal/privacy-notice/

We use the technical platform and services of the respective providers for these information services. We would like to point out that you use our presence on social media platforms and their functions at your own risk. This applies in particular to the use of interactive functions (e.g. commenting, rating, sharing).

When you visit our social media pages, the platform providers collect your IP address and other information that is stored on your device in the form of cookies. This information is used to provide us, as the operator of the accounts, with statistical information about your interactions with our posts. The data collected about you is processed by the platforms and may be transferred to countries outside the EU, in particular to the USA.

The providers mentioned above are either certified under the EU-US Data Privacy Framework (DPF) and/or we have concluded EU standard contractual clauses (SCCs) with these providers in accordance with Art. 46 para. 2 lit. c GDPR, which ensure compliance with the EU level of data protection.

We do not know how the social media platforms use the data from your visit to our account and your interactions with our posts for their own purposes, how long this data is stored and whether it is passed on to third parties. Data processing may vary depending on whether you are registered with the social network and logged in or whether you visit the site as a non-registered and/or non-logged-in user. When you access a post or our account, the IP address assigned to your end device is transmitted to the provider of the social media platform. If you are currently logged in, a cookie may be used on your device to track your online behavior. The platforms can use buttons integrated into websites to record your visits to these websites and assign them to your profile in order to offer you targeted content or advertising. To avoid this, you should log out, deactivate the "stay logged in" function, delete the cookies on your device and restart your browser.

As the provider of the information service, we also only process the data that you provide to us when using our service and which requires interaction. For example, if you ask us a question that we can only answer by email, we will store your data in accordance with the general principles of our data processing, which are described in this privacy policy. The legal basis for the processing of your data on the social media platform is Art. 6 para. 1 sentence 1 lit. f GDPR.

In the event of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

The providers of the social media platforms explain in their privacy policies what information they receive and how it is used. These privacy policies (see links above) also contain information about contact options and the settings options for advertising.

IX. Storage and deletion of data

The data processed by us will be deleted in accordance with the statutory provisions as soon as the consent given for processing is revoked or other permissions cease to apply (e.g. if the purpose for processing this data ceases to apply or it is no longer required for the purpose). This means that we only store your personal data for as long as is necessary for the respective processing purpose and limit the storage period to the minimum necessary. In addition, we only store your data if we are entitled or obliged to do so in accordance with the statutory retention periods.

This Privacy Policy may also contain further information on the retention and deletion of data, which primarily relates to the respective processing activities.

YOUR RIGHTS AS A DATA SUBJECT

You have the right to

• Access to your personal data in accordance with Art. 15 GDPR,
• Rectification of inaccurate personal data in accordance with Art. 16 GDPR,
• erasure of your personal data in accordance with Art. 17 GDPR,
• Restriction of processing in accordance with Art. 18 GDPR,
• objection to the processing of your data pursuant to Art. 21 (right to object, see details below), and
• data portability in accordance with Art. 20 GDPR.

As set out in the relevant sections of this Privacy Policy, you have the right to withdraw your consent to the processing of your personal data at any time. Please note that the withdrawal of consent is only effective for future processing. Processing that took place before the withdrawal remains unaffected.

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR; this also applies to profiling based on this provision within the meaning of Article 4 (4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

To exercise your above rights, you can send an email to info@talesofus.com. You also have the right to complain to a data protection supervisory authority about the processing of your personal data.

DATA PROCESSING WHEN ACCESSING LINKED CONTENT

AUTOMATED DECISION-MAKING/PROFILING

CHANGES TO THIS PRIVACY POLICY

Due to the further development of our website, our online offering and our services or due to changes in legal or regulatory requirements, it may be necessary to amend this privacy policy from time to time.

If you have any questions regarding the processing of your data, you can contact us at any time.