KEYSTORM PRIVACY POLICY

Last updated: September 8, 2026

1. ABOUT US

1.1. We are KEYSTORM HOLDINGS LTD, a company established and operating under the legislation of Cyprus (reg. number: ΗΕ 384054), with its registered office at Karaiskaki, 13, 3032, Limassol, Cyprus (“COMPANY”). This Privacy Policy (the “Privacy Policy”) describes how we process your personal data when you (a) visit COMPANY’s websites; (b) use COMPANY’s mobile, online, console, and downloadable products and other services that reference this Privacy Policy (collectively the “Services”).

1.2. We highly respect your privacy and comply with applicable laws, including, without limitation, the European Union General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), the UK GDPR, the Lei Geral de Proteção de Dados (“LGPD”), consumer privacy laws of Virginia, California, Colorado, Connecticut, Utah and other states and jurisdictions.

1.3. The following documents are integral parts of this Privacy Policy and are included in separate documents solely for your convenience: . This Privacy Policy shall be read alongside and in addition to other documents that govern the use of our Services, i.e. End User Licence Agreement, and others as they may be published from time to time (collectively referred to as the “User Documentation”). Capitalized words not defined in this Privacy Policy shall have the meaning prescribed to them in the User Documentation. In case of any contradictions between this Privacy Policy and the documents indicated above, this Privacy Policy prevails in all matters regarding your personal data.

2. CONTACT US

2.1. If you have any questions, please send your inquiries to our Support Service or send your request to us in writing to the COMPANY’s address. “Support Service” means the support service of the COMPANY that considers User requests sent through . Please, quote this Privacy Policy so we can deal with your inquiry efficiently. We will aim to respond to you within 15 days from receipt of your request or a shorter period as may be prescribed by the applicable law.

2.2. We will need to verify your identity before we are able to process your inquiry and may request additional documentation or information solely for the purpose of verifying your identity.

2.3. All correspondence received by us from you (written or electronic inquiries) is classified as restricted-access information and may not be disclosed without your written consent, unless otherwise prescribed by the applicable law. The personal data and other information about you, which we receive alongside with your inquiry, may not be used without your consent for any purpose other than for responding to the inquiry, except as expressly provided by law.

2.4. We have appointed a Data Protection Officer (“DPO”). If you have any questions about your personal data processing, the enforceability of this privacy policy, or any other privacy concern, contact our DPO at .

3. INFORMATION WE COLLECT ABOUT YOU

The information we collect about you depends on how you interact with us. We collect and/or create information in three main ways: A) when you give it to us, B) automatically when you use our Services, and C) from third parties.

We do not check the user information received by us, except where such a check is necessary for us to fulfill our obligations to you.

3.1. Information you give us directly when using our Services

We collect information that you provide to us directly, such as:

3.2. Information we collect automatically when you use our Services

We may collect other information automatically when you use our Services, such as:

3.3. Information provided by third parties

We may receive information about you from third parties, such as:

4. LEGAL BASIS FOR PROCESSING

In course of processing your personal data, we rely on one of the legal bases described below, which vary depending on the type of information we process and the context in which we collect it.

4.1. Performance of our contract with you

We use the following information to provide, manage, and administer the Services in accordance with the User Documentation, as well as to enable us to fulfil our obligations to you as part of the Services including without limitation to communicate with you in order to provide you with updates and information as well as to fulfil your support request:

4.2. Legitimate interests

We may process the following information based on the legitimate interests for the reasonably expected purposes, such as to: prevent fraudulent activity in our Services; ensure that your data is safe and adequately protected; improve our Services; better understand you and your preferences and provide you with better and personalized user experience; process the data that was manifestly made public by you where it is accessible by other users of the Services; measure the effectiveness of advertisements and, advertisement attribution (such as attribution of the impressions, installs, clicks or other advertising campaign performance):

4.3. Consent

We use the following information when you provide us with your consent to do so, including without limitation to serve you with a personalized ads experience, tailor and improve the advertisements that are presented to you:

If you do not want your personal data to be longer processed for the requested purposes, you may withdraw your consent at any time by contacting us using the contact details indicated in Section 2 above.

4.4. Legal obligations

We process personal data when necessary to comply with legal obligations

We may process the following information in order to comply with any contractual, legal, or regulatory obligations under any applicable law, for instance, to respond to legitimate requests from law enforcement authorities, in the defence or exercise of legal claims, or to comply with applicable children protection laws:

5. HOW WE USE YOUR INFORMATION

5.1. Based on the corresponding legal bases and in compliance with applicable laws, we will collect, store, aggregate, organize, extract, compare, use, and supplement your personal data as described herein. We will also receive and pass this data, and our automatically processed analyses of this data, to our affiliates and partners as set out herein.

5.2. Advertising disclaimer

Our ad management and recommendation system is designed so that your information will not be shared directly with our advertising partners. An advertiser or maker of a recommendation can only choose to target advertisements to groups of users falling within criteria such as general location (country, city), or other, or to target communities according to their types. If you fall within one of the target groups, you will receive an advertisement or recommendation of such advertising partner or our affiliates. However, such advertising partner or our affiliates may gather some of your information in case you interact in any way with the ads provided by it.

In some cases, we will rely on your consent to provide your personal information to third-party advertisement networks in order to serve you with a personalized ads experience. The purpose of showing personalized ads is to improve our Services and your experience therein and to provide you with content relevant to your interests. You have the option to withdraw your consent for personalized advertising at all times by changing your choice in the App settings through Privacy Setting (in some cases it might be named Privacy) button.

In case you provided us with consent to the sending of marketing information, you may withdraw your consent to the sending of marketing information to you by amending your privacy settings in your Account. An option to unsubscribe will also be included in every SMS or e-mail sent to you by us or our selected third party partners.

Once you withdraw your consent you still might see a number of ads while using Services, that might be less relevant to your interests and they will not be based on topics you like. The advertisement might be based on the content you are using, i.e. contextual advertisement.

5.3. Retargeting disclaimer

An advertiser or maker of recommendations may also choose to upload a list of identifiers (e.g., e-mails, phone numbers) and identities to our systems so that we (but not the advertiser or maker of recommendations) can check for user matches. They will see the number of matches but not the matches themselves.

5.4. Retention

We will retain your personal data for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and/or whether additional legal/regulatory obligations mandate that we retain your personal data during the term that is required and/or permissible under applicable law.

You may either delete your personal data by removing the data from your Account, or by deleting your Account in its entirety. Alternatively, you may request us to do so by contacting our Support Service.

We may remove your Account or the information you post, as provided in the User Documentation. At the same time, we will not delete personal data if it is relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved and/or during the term that is required and/or permissible under applicable law.

Where possible, we may also de-identify, anonymize, or aggregate the information we collect, or collect it in a way that does not directly identify you. We may use and share such information as necessary for our business purposes and as permitted by applicable law.

6. DATA SHARING

6.1. If it is reasonably justified, we may share your personal information with the categories of recipients only in the ways that are described in this Privacy Policy. The transmission of personal data to such recipients is carried out in a secure manner and in application of an agreement between us and each recipient as may be necessary under applicable law.

We will not share your personal data outside the scope of purposes specified herein this Privacy Policy without your prior consent.

6.2. With service providers

We may involve service providers that help us operate our business and provide you with Services, for instance, to administer the billing services. All such service providers act on our behalf and strictly under our instructions.

6.3. With business and advertising partners. Sometimes in order to provide, manage, and administer the Services we may need to provide your data to our partners with whom we jointly offer Services (such operators of Third Parties Platform). With the intent to personalize, adjust, and improve our Services, we may integrate third parties’ analytical systems in our Services to perform measurement of our websites and Services, as well as SDKs of advertisement networks and other business partners, including for the purposes of providing you with targeted advertising based upon your interests. Our network partners also may use tracking technologies to collect information about your activities to provide you targeted advertising based upon your interests.

Such business and advertising partners and their respective privacy terms, which may be applied to you, for your convenience are indicated in the List of the parties who may receive data which is an integral part hereof. From time to time, we may change and/or the indicated list. We recommend you regularly review the list to ensure that you are always aware of the current information.

The Services may contain links to websites operated by third parties. We are not responsible for your data privacy when you access these links or engage with third party services, and you shall ensure that you review the relevant third party’s privacy statement, which will govern your data privacy rights.

6.4. With affiliates and subsidiaries

We may disclose personal information to our affiliates and subsidiaries in which we have an ownership interest as necessary solely for the purposes outlined herein.

6.5. Disclosure in the event of merger, sale, or other asset transfer

You hereby consent that we may also transfer your personal data to a third party if we decide to transfer or sell all or substantially all of our business or any of our Services separately to which this Privacy Policy relates, whether by merger, sale of stock, sale of assets, or otherwise, if permitted by and done in accordance with applicable law, so that you can continue to receive service and information in connection with the Services with as little disruption as possible. Similarly, you hereby consent that in that case in order to ensure that your game progress, In-Game Assets and In-Game Currency (as the case may be) will be saved, your personal data will be processed by our successor or assignee.

6.6. With other users and/or the general public

Your username and other information that you provide or post while using the Services can be available to all users of the Services. We may also publish your data as part of the tournament score tables on our and external websites and for similar purposes related to the gameplay or functionality of the Services. We take technical and organizational measures to ensure that your data is safe. Please note, that by posting your personal data in publicly accessible areas (resources accessible by other users of the Services), you have manifestly made this information public, and it may become available to other users of the Services and Internet users and be copied and/or disseminated by such users. Please keep in mind that once other users have gained access to or copied your data, neither you nor we are able to delete or remove such data from the possession of those other users.

Please note, that if you do not want us to process certain personal data, such as sensitive and special categories of data about you (including data relating to your health, racial or ethnic origin, political opinion, religious or philosophical beliefs, sex life, and/or your sexual orientation), you have to take care not to post this information or share this data on our websites and/or Services. Once you have provided this data, it will be accessible by other websites users and it becomes difficult for us to remove this data.

We bear no liability for the actions of third parties, which, as the result of your use of the Internet or the Services, obtain access to your information in accordance with the confidentiality level selected by you. We bear no liability for the consequences of the use of the information that, due to the nature of the Services, is available to any Internet user. We ask you to take a responsible approach to the scope of the information posted on our websites and Services.

6.7. Disclosure required by law or in the event of a dispute

We may share your information if we, in good faith, believe it is required by applicable law, regulation, operating agreement, governmental request, or legal process, such as a court order, subpoena or disclosure to tax or other authorities. We may also share your information in special cases when we have reason to believe that disclosing such information is necessary to identify, contact, or bring legal action if you or third parties are violating the User Documentation, or any applicable law, for the purpose of defence of our or third parties’ rights and interests. We may also keep some of your personal data in our business records for accounting and compliance purposes.

7. INTERNATIONAL TRANSFERS

7.1. Sometimes, when it is reasonably necessary, we may transfer and maintain some of your personal data on our or our partners’ servers or databases outside the European Economic Area (EEA), including in CIS.

7.2. Some of the countries to which we transfer your data may not have the same data protection laws as your jurisdiction. In such case, we will take reasonable cyber security measures and/or put in place where required the Standard Contractual Clauses (e.g. Model Clauses, Data Processing Agreement/Addendum) to ensure your data is adequately protected.

8. YOUR RIGHTS

8.1. Under applicable data protection law, you have the following rights, including:

You also can independently remove personal information on your account and make changes and corrections to your information, provided that such changes and corrections contain up-to-date and true information. You can also view an overview of the information we hold about you.

You do not need to pay a fee to exercise your rights. To make an access or deletion request, to make a complaint, if you have any concerns about our use of your personal information, as well as to exercise any of your other rights prescribed by applicable law, please contact us using the contact details indicated in Section 2 above.

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to a competent supervisory authority depending on your location.

If you are a US resident, your local data protection authority may also forward the matter to the Department of Commerce or FTC for consideration.

8.2. You may have other rights under the legislation of your country of residence, including right to define the instructions relative to the outcome of your personal information after your death, and other rights listed below.

8.2.1. Information for US residents

This Section explains your privacy rights if you are located in California, Virginia, Colorado, Connecticut, Utah, or another US state which grants you similar rights, prescribed by the California Consumer Privacy Act, Cal. Civ. Code 1798.100, et seq (“CCPA”), Virginia Code § 59.1-571 (Virginia Consumer Data Protection Act), Col. Rev. Stat. § 6-1-1303(24) (Colorado Privacy Act); Connecticut Public Act No. 22-15 § 1(27) (Connecticut Data Privacy Act), Utah Code § 13-61-101(32) (Utah Consumer Privacy Act), etc.

Mandatory disclosures. In addition to the information provided elsewhere in our Privacy Policy, we make the following disclosures for purposes of compliance with the CCPA:

The sources of personal information that we collected are: directly from you, from other users; from third party sites or platforms that you link with your registration account; from analytics tools, social networks, advertising networks, and trusted sources who update or supplement information we hold about you.

The business or commercial purposes of collecting personal information are described in the Section 3 hereof.

Some of our partners may collect and process information when you interact with our Services, including IP addresses, digital identifiers, information about your web browsing and app usage, and how you interact with our advertising properties and ads in order to provide you with relevant ads across the Internet and for other analytics purposes, and such partners may “sell” that information to other businesses for advertising and other purposes under the definition of “sale” in the CCPA.

The business or commercial purposes of “selling” personal information is for third party companies to perform services on our behalf, like marketing, advertising, performance and audience measurement.

We do not “sell” personal information of known minors under 16 years of age.

You have the following rights, additionally to the rights mentioned above, if you are located in California, Virginia, Colorado, Connecticut, Utah, or another US state which grants you similar rights:

Residual copies of content and/or information that have been deleted may remain on our backup servers. We do not have to remove posted content or information if it has been rendered anonymous. We may retain your information to resolve disputes, enforce our user agreements, or comply with legal requirements; in this case, your personal information will be blocked from use for any other purpose. Additionally, we do not have control over third parties (e.g., other users) who may have copied or reposted the content or information.

Shine the Light Act - California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by us and our affiliates to third parties for the third parties’ direct marketing purposes. We are dedicated to treating your personal information with care and respect.

Authorized agents - If you would like to designate an authorized agent to make a request on your behalf, please be sure the agent can (i) demonstrate you have provided written permission for the agent to submit the request on your behalf, and (ii) provide proof of his or her own identity. If the agent does not satisfy these requirements, we will deny the request.

Privacy rights for California minors - If you are a California resident under the age of 18, California Business and Professions Code Section 22581 permits you to view, correct and request the removal of content or information you have posted to the site, message boards. Note that any information posted to the message boards is publicly viewable. We strongly recommend that all users avoid posting personal or sensitive information.

Online Tracking/Do Not Track. We and our third-party service providers may use cookies, pixels, or other tracking technologies to collect information about your browsing activities over time and across different websites. California Business and Professions Code Section 22575(b) (as amended effective January 1, 2014) permits our users who are California residents to be informed as to how we respond to Web browser “Do Not Track” settings. As Do Not Track is a standard that is currently being developed, we do not take actions to respond to Do Not Track settings, and instead we adhere to the standards set out in this Privacy Policy.

9. SECURITY MEASURES

9.1. We take technical, organisational, and legal measures, including, where suitable, encryption, to ensure that your personal information is protected from unauthorised or accidental access, deletion, modification, blocking, copying, and dissemination.

9.2. Access to the Services is authorised using your login (e-mail address or mobile phone number) and password. You are responsible for keeping this information confidential. You shall not share your credentials with third parties and we recommend you take measures to ensure this information is kept confidential.

9.3. If you forget your login details, you can request us to send you an SMS or e-mail, which will contain a restoration code.

9.4. To reduce the probability of third parties gaining unauthorised access, if you login to your account from an unusual place or after several failed attempts to provide valid login details, we may block entry to your account. You will then need to contact us using the contact details indicated in Section 2 above and provide certain additional information to verify your credentials and gain access to your account.

10. PRIVACY NOTICE FOR PARENTS/LEGAL GUARDIANS

10.1. The Services are intended to be appropriate for general audiences and are not specifically aimed at children (the exact age is determined depending on the applicable law). We do not intentionally collect personal data from children without obtaining necessary parental approval in accordance with applicable legislation, such as the U.S. Children’s Online Privacy Protection Act and the UK Age appropriate design code. Authorized child accounts are treated like other accounts unless otherwise required by applicable law. Children can get access to the Services with a suitable age restriction and can exercise rights available to other Users. For additional details about what personal data we collect from children, how we use that personal data and information regarding Our disclosure practices for such information, please see Sections 3 and 6 hereof. Please note that during the use of the Service children as the other Users may make their personal data publicly available by posting their personal data in publicly accessible areas (resources accessible by other users of the Services). We encourage parents to discuss with their children the importance of personal data protection.

10.2. We will not require a child to provide more information than is reasonably necessary in order to use the Services.

10.3. If under applicable law a parental consent is required, children can use the Services and register Account only with the parental consent. For the purpose of parental consent, when setting up an Account, a child is invited to provide the email address of his/her parent/ legal guardian. We use that email address to contact the child’s parent/legal guardian to ask for his/her consent for the child’s registration on the Service and our use of the child’s personal data in respect thereof. Information on the parental consent (with email address of parent/ legal guardian) shall remain available on the Service. We will use the email address of the parent/ legal guardian solely for parental consent purposes.

10.4. At any time, parents/legal guardians shall have the right to review their child’s personal data, the right to refuse to permit us to further collect or use their child’s personal data, and the right to request the deletion of their child's personal data. Parents/legal guardians can exercise any right indicated herein by sending a corresponding request using the contact details indicated in Section 2 above

10.5. For the matters related to children’s personal data collecting parents/legal guardians can contact us using the contact details indicated in Section 2 above.

11. CHANGES TO THIS PRIVACY POLICY

11.1. From time to time, we may change and/or update this Privacy Policy. If this Privacy Policy changes in any way, we will post an updated version on this page. We will store the previous versions of this Privacy Policy in our documentation archive. We recommend you regularly review this page to ensure that you are always aware of our information practices and any changes to them.