Effective Date: March 26, 2024

This Privacy Policy applies to the BFB Sport services provided by BFB Sport (referred to as " BFB Sport" or "we" or "us") and other related services, collectively referred to as the "Service." We may periodically update this Privacy Policy and post new versions at www.bfbsport.com. If we make any material changes, we will notify you in accordance with applicable law, including posting such changes before they take effect.

In this Privacy Policy, "personal information" or "personal data" means information about you (the data subject) that can be used to directly or indirectly identify you. This information includes but is not limited to your name, email address, phone number, payment details, purchase history, and Internet Protocol (IP) computer address.

Important Note: If you do not agree with any terms or conditions described in this Privacy Policy, please do not use our services.

Data We Collect

The categories of personal data we collect depend on the services you use and the requirements of applicable law.

(1) Data You Provide Directly to Us.

• Contact Information: such as name, email address, or phone number
• Registration Information: ID, password, age
• Content Information: messages and other content you submit while using the Service (e.g., chat logs)
• Survey Information: data you provide related to surveys, promotions, contests, and other activities
• Transaction Information/Payment Details: additional data you choose to provide to us for certain services (e.g., bank account, credit card, debit card, or any other financial information)
• If you use payment services from our payment service providers, we will collect your payment details

(2) Data We Automatically Collect.

• Device and Log Information: your IP address, data about your device such as device name and operating system, browser type and language, Internet service provider, mobile carrier, and approximate location data (derived from IP address)
• Cookies: data we collect through cookies
• Service Usage Information: data about your use of the service, such as game data, payment records, transaction records

(3) Data We Collect from Partners.

We also use third-party partners (such as data analytics providers) to supplement the information we have about you, such as:

• Third-party analytics data: demographic data (e.g., approximate location determined by your IP address), data for analytical purposes (e.g., surveys) to help us provide better services
• Third-party payment information: data from payment service providers (e.g., payment verification data)

Why We Collect Your Data

We use your data for various business purposes, such as:

(1) Providing Our Services.
We process necessary data to:
Create accounts and allow you to use our services
Operate the service
Verify and confirm payments
Provide and deliver products and services you request

(2) Creating and Providing Better Services.
To provide better services to our users, we collect and process necessary data to:
Update services
Develop and improve services
Manage our relationship with you
Customize your service experience
Answer your questions and provide customer support
Send you relevant information such as updates, security alerts, and support messages

(3) Displaying Personalized Advertising.
To show personalized advertisements for services, we process necessary data to:
Track content related to the service you visit and your online behavior
Deliver, target, and improve our advertisements and services
For information on how to opt out of personalized advertising, see the "Your Rights and Options" section below.

(4) Ensuring Service Security and Fairness.
To ensure the security and fairness of the service, we process necessary data to:
Analyze and monitor service usage
Automatically or manually moderate chats
Take action against fraudulent or inappropriate behavior by users

(5) For Purposes Required by Law. We process personal information to the extent necessary to:

• Comply with court orders and subpoenas, and respond to legally binding requests from governments, law enforcement agencies, public authorities, and/or regulatory authorities
• Protect our legitimate rights, including by processing complaints, obtaining legal advice, and asserting, exercising, or defending legal claims related to us and our services

With your consent, we may process your data for other purposes.

Who Can See Your Data

In addition to us, others may access your data in the following cases:

(1) Other Players and Users.
If you use our gaming services, other players and users of that game may see your profile data, in-game activities, and read messages you post.

(2) Our Service Providers.
We have vendors who help us provide services. These vendors process your data only according to our instructions to provide services and perform tasks (i.e., customer support, advertising, analytics).

(3) Other Companies and Public Institutions.
To verify payments and illegal activities, we may process and disclose data with other companies and organizations and provide them to public authorities as required by law. We may also disclose your data when required by law or to protect our rights, property, or safety of our users or others.

(4) Mergers and Corporate Transactions.
If we undergo a business transformation such as a merger, acquisition, joint venture, corporate divestiture, dissolution, asset sale, or similar transaction, we may share, disclose, or transfer your information, including personal information, to companies such as parties to such transactions.

(5) With Your Permission.
Additionally, if you choose to join or otherwise consent to share your information with third parties (or multiple third parties), we will accordingly share your information, in which case, the third party's use of your information is subject to their own privacy policies.
We may use depersonalized information in any way, including sharing it with third parties without your consent. Additionally, we may share some of the information we collect from you when you install mobile applications with vendors and other service providers who operate our services and/or for analytical purposes as may be needed. and the display of non-personal information. You can follow the instructions provided by our third-party analytics providers to "opt out" of the collection of your information for third-party analytics purposes. If you "opt out" of a particular third-party analytics provider, this action is only for that provider and does not otherwise limit our collection of information under the terms of this Privacy Policy.

6. International Data Transfers
Additionally, your use of this service may involve the transfer, storage, and processing of your personal information to other countries; for example, Switzerland. We will take appropriate measures in accordance with applicable law to ensure the protection of your personal information. Such measures include using EU Commission standard contractual clauses for protecting information transfers outside the European Economic Area and relying on your explicit consent. Additionally, the EU Commission recognizes that certain countries and territories outside the European Economic Area provide sufficient protection for personal information—this is known as an "adequacy decision," copies of which can be found here: https://ec.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
For more information or copies of contract agreements or other existing safeguards, please contact us. See the "Contact Us" section above for details.
7.Your Rights and Choices
Note: To protect your privacy, we may also take additional steps to verify your identity before fulfilling your requests, such as requesting your email address, phone number, or asking you questions about your activities on our service.
(1) Opting Out of Marketing Emails and Other Direct Marketing.
You can choose not to receive promotional communications, such as marketing emails we send, by following the instructions in such communications or changing settings within the website. Updated settings may not take effect immediately. Please note that you may still receive non-promotional communications from us, such as communications about the service or updates to our terms of service, privacy policy, and other related policies.

(2) Push Notifications
We may send push notifications to your mobile device through our mobile applications. You can opt out of receiving these types of communications at any time by changing settings on your mobile device.

(3) Opting Out of Targeted Advertising.
You can opt out of interest-based advertising on our mobile applications by changing settings on your mobile device, PC, or other devices.

(4) Access Rights.
You have the right to request access to any personal information we hold about you. You can send an email to support@bfbsport.com. and requesting your information. We will provide this information to you within [10] working days of receiving your request. Unless requested otherwise, your information will be provided to you in a machine-readable format. Please note that depending on the format type, it may take longer.

(5) Right to Rectification.
If your personal information is inaccurate, you can request correction. You can send an email to support@bfbsport.com. In some cases, we may provide self-service tools to allow you to update some of your personal information.

(6) Right to Erasure.
If you have provided consent for us to use your information for specific purposes, you can contact us to withdraw that consent, but this will not affect any processing that has already taken place. When you make such requests, we may need time to investigate and assist with your request. If any delay or dispute arises regarding our right to continue using your information, we will restrict all further use of your relevant information until the request or dispute is resolved. To delete your account or request that we cease using your information to provide services to you, please contact us at support@bfbsport.com; we will respond to your request within [10] working days. Note: In some cases, we may be unable to delete your personal information and may retain and use it as necessary to comply with our legal obligations, resolve disputes. If you delete your account, you will permanently lose access to our services.

(7) Right to Restrict Processing.
When there is a dispute about the accuracy of your personal information or the legality of information processing, you may suspend the processing of your personal information.You can send an email to support@bfbsport.com.
(8) Right to Data Portability.
You may request the provision or transfer of information. You can send an email to support@bfbsport.com.

(9) Right to Object.
If your personal information is used for direct marketing, legitimate interests, exercising official authority and powers, research, and statistical purposes, you may suspend the processing of your personal information. You can send an email to support@bfbsport.com.

(10) Right to Automated Decision-Making, Including Profiling.
You may request the cessation of automated processing of personal information, including profiling, which has a significant effect on you or has legal consequences. You can send an email to support@bfbsport.com.

8.Cookies
We may collect aggregate and non-personal information through cookies or similar technologies. Cookies are small text files stored on a user's terminal device when they visit our website or use our services. They allow users to be recognized upon revisiting the website and optimize the display of content.

9.Security of Your Information
We implement reasonable security measures to protect your information and continually update our technology to better safeguard your information. While we take reasonable precautions against potential security vulnerabilities, we cannot guarantee unauthorized access, hacking attacks, data loss, or other breaches will not occur. If we discover any security issues with your personal information, we will notify you within 72 hours of such issues. We urge you to take measures to protect the security of your personal information, use strong passwords, log out of your account after use, and use different passwords for different services from different companies. You must also help protect and maintain the security of your account, which is important. Notify us immediately of any unauthorized use.

10.Minors
Protecting the privacy of minors is of utmost importance to us. Our services are not directed to individuals under the age of 18 (or any other age required by local law), and we do not knowingly collect personal data from minors. While our services are not directed at minors, they may still be attracted to them, and we take additional steps to restrict access to our services based on user age restrictions. Accordingly, when users indicate that they are under the age of 18 (or the applicable age in their jurisdiction), we restrict their access to certain services.

11.Contact Us
If you have questions about data protection or any requests to address personal data issues, please primarily contact us through the following channels.
Email: support@bfbsport.com

12.Regional Privacy Disclosures
The following additional terms apply specifically to users in certain countries/regions. If the following additional terms conflict with the provisions of the main text of this Privacy Policy, the following terms shall prevail.
(1) For Residents of the European Economic Area (EEA), United Kingdom (UK), and Switzerland
This section is a supplement to the privacy policy and applies only to residents of the European Economic Area (EEA), United Kingdom (UK), and Switzerland.

The privacy policy section 2 should be replaced with the following:

2. How We Use Information We Collect

(1) Providing services based on our contractual relationship with you According to our contract with you, we may process data as necessary to:

• Create accounts and allow you to use our services
• Operate the service
• Verify and confirm payments
• Provide and deliver the products and services you request
• Analyze and monitor service usage
• Automatically or manually manage chats
• Take action against fraudulent or inappropriate behavior by users

[When processing your personal information for these purposes, we use your contact information, registration information, content information, and transaction information.] The legal basis for such processing in the EU/EEA is GDPR Article 6(1)(b).

(2) Using information for further purposes based on our legitimate interests

We process, analyze, and store personal information within the scope necessary to achieve our legitimate interests (or those of third parties), including our interests in:

• Providing services
• Developing and improving services
• Managing our relationship with you
• Customizing your service experience
• Answering your questions and providing customer support
• Sending you relevant information such as updates, security alerts, and support messages

We have conducted balancing tests when relying on legitimate interests to consider the impact of processing on individuals and determine whether individuals' interests outweigh our interests. For more information on this balancing test, please contact us using the contact details provided in this privacy policy.

[When processing your personal information for these purposes, we use your contact information and registration information.]

The legal basis for such processing in the EU/EEA is GDPR Article 6(1)(f).

(3) Using information based on your consent

We process and use your personal information in the following cases:

To show personalized advertising for services, we process necessary data to track content related to the service you visit, your online behavior, and deliver, target, and improve our advertisements and services

For information on opting out of personalized advertising, please see the "Your Rights and Options" section below.

[When processing your personal information for these purposes, we use your transaction information.]

The legal basis for such processing in the EU/EEA is GDPR Article 6(1)(a).

(4) Processing for purposes required by law

We process personal information as necessary to:

• Comply with court orders and subpoenas, and respond to government, law enforcement, public authorities, and/or regulatory authorities
• Protect our legitimate rights, including processing complaints, obtaining legal advice, and asserting, exercising, or defending legal claims related to us and our services

When we need your information to fulfill contracts with you or comply with our legal obligations, you need to provide this information to us. In other cases, you are not required to provide personal information, but not doing so may affect how you use our services.

[When processing your personal information for these purposes, we use your contact information.]

The legal basis for such processing in the EU/EEA is GDPR Article 6(1)(c) and relevant EU/EEA or national legislation.

The privacy policy section 6 should be replaced with the following:

12. Automated Decision-Making

We will not make decisions that may affect you solely based on automated processing of your personal data. All decision-making processes related to the processing purposes mentioned above are conducted with human intervention.

13. Personal Information of Children

Without the consent of parents or legal guardians, we will not collect personal information of children under the age of 18 or the equivalent minimum age according to the jurisdiction. Therefore, before using our services, we will ask you to provide age-related information to help us comply with data protection laws. In particular, we will ask for your date of birth to determine if you can benefit from the service or if we must obtain verifiable parental consent from you parents or relevant parental responsibility holders before allowing you access and/or benefits from the service.

14. Your Rights

For contact information for all EU regulators, please see https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080. In cases where the French Data Protection Act applies, you also have the right to establish guidelines for the retention and communication of your personal information after your death.

15. European Data Protection Representative

You can contact us through our European data protection representative by sending an email to the following address: [support@bfbsport.com]

(2) For California Consumers

This section is a supplement to the privacy policy and applies only to California consumers.

1. Information We Collect

We collect personal information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information”). Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.

In particular, in the past twelve (12) months, we have collected the following categories of personal information from consumers:

Category of Personal Information Collected Examples of Data Collected Whether Collected

1. Identifiers. Real name, online identifier, IP address, email address, account name (ID), or other similar identifiers Yes
2. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Name, address, phone number, bank account number, credit card number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories. Yes
3. Characteristics protected under California or federal law. Age Yes
4. Commercial information. Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Yes
5. Internet or other similar network activity. Browsing history, information on a consumer's interaction with a website, application, or advertisement. Yes
6. Inferences drawn from other personal information. Profiles reflecting a consumer's preferences, characteristics, and behavior. Yes The sources of the above data are described in the "Data We Collect" section of the privacy policy.

2. Use of Personal Information

We may use (and may have used in the past twelve (12) months prior to the effective date of this privacy policy) the personal data categories described in the "Why We Collect Your Data" section of the privacy policy for the following business purposes:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage or similar services;
• Auditing related to a current interaction with the consumer's ad impressions, verifying ad impressions' positioning and quality, and auditing compliance;
• Providing you with advertising and marketing services;
• Short-term, transient use, including but not limited to displaying non-personalized ads as part of your current interaction with us;
• Helping ensure security and integrity within the scope reasonably necessary and appropriate for these purposes of consumer personal information;
• Debugging to identify and repair errors that impair existing expected functionality;
• Conducting internal technical development and demonstration research;
• Conducting activities to verify or maintain the quality or safety of services, or improve, upgrade, or enhance services.

3. Retention Period

The retention period of personal information is described in the "Retention Period" section of the privacy policy.

4. Data Disclosure and/or Sale

We do not sell your personal data to third parties. However, we may share (a) your cookie information and advertising identifiers with our third-party advertising platforms to provide interest-based advertising, attribute installations, and optimize campaign effectiveness; and (b) your personal information with third-party game service providers who provide game services on BFB sport. These third-party partners may access your data and operate according to their own privacy policies. We encourage you to review their privacy policies to learn more about their data processing practices. If such practices are considered "sales" under the CCPA, you can opt out of such sharing as described in the "Opting Out of Targeted Advertising" section of the privacy policy. We do not actually know of any sales of personal data of consumers under 16 years of age, as the term "sale" is defined under the CCPA.

In the past twelve (12) months, as part of our service, we have disclosed the following categories of personal data:

Category of Personal Data Collected Examples of Data Collected Categories of Third Parties to Whom Personal Data is Sold for Business or Commercial Purposes Identifiers. Real name, unique personal identifier, online identifier, IP address, email address, account name (ID), or other similar identifiers Other game players (ID and profile only)

Service providers

Business partners (e.g., third-party game service providers)

Advertising networks (only advertising identifiers and IP addresses)

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Name, address, phone number, bank account number, credit card number, debit card number, or any other financial information Payment service providers

Characteristics protected under California or federal law. Age Service providers

Business partners

Commercial information. Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Service providers Advertising networks

Internet or other electronic network activity. Browsing history, information on a consumer's interaction with a website, application, or advertisement. Service providers Advertising networks

Inferences drawn from other personal information to create a profile reflecting a consumer's preferences, characteristics, and behavior. Service providers

In addition to the above sharing, we may also share any information we collect about you with our affiliates to protect ourselves or others, or in the event of a merger, sale, or other asset transfer.

For more information, please see the "Who Can View Your Data" section of the privacy policy.

5. Use or Disclosure of Sensitive Personal Information

We do not use or disclose your sensitive personal information.

6. Your Rights and Choices

(1) Right to Know and Data Portability

You have the right to request that we disclose certain information about our collection, use, sale, or sharing of your personal information in the past twelve (12) months ("right to know"). Once we receive your request and verify your identity (please see Exercising Your Right to Know or Delete), we will disclose to you:

• The categories of personal information we have collected about you.
• The categories of sources from which we collected your personal information.
• The business or commercial purposes for which we collected or sold that personal information.
• The categories of your personal information that we sold or shared for a business purpose, and the categories of third parties to whom we sold or shared that personal information.
• If we sold or disclosed your personal information for a business purpose, there will be two separate lists disclosed:
• Sales, identifying each category of personal information sold by category of recipient; and
• Disclosures for a business purpose, identifying each category of personal information obtained by each category of recipient.
• The specific personal information we collected about you (also known as data portability requests).

(2) Right to Deletion

You have the right to request that we delete any personal information we collected and retained about you, subject to certain exceptions ("right to deletion"). Once we receive your request and verify your identity (please see Exercising Your Right to Know or Delete), we will review your request to see if there are exceptions that allow us to retain the information. We may deny your deletion request if we or our service providers need to retain this information to:

1. Complete transactions for which we collected personal information, provide you with requested goods or services, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or other contract between us and you that you have reasonably expected within the context of our ongoing business relationship;
2. Detect security incidents, prevent malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
3. Debug products to identify and repair errors that impair existing expected functionality;
4. Exercise free speech, ensure other consumers' exercise of free speech rights, or exercise other rights provided for by law;
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, where deletion of the information may render the research results impossible or seriously impair them (if you previously provided informed consent);
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
8. Comply with legal obligations;
9. Use the information for other internal lawful purposes compatible with the context in which you provided the information.

We will delete or deidentify personal information not exempted from these exceptions from our records and will instruct our service providers to take similar actions.

(3) Exercising Your Right to Know or Delete

To exercise your right to know or delete, please submit your request by:

• Sending an email to [support@bfbsport.com].

Only you or someone legally authorized to act on your behalf may request to know or delete requests related to your personal information.

You may also make requests to know or delete on behalf of your child by providing sufficient information for us to reasonably verify your relationship with the child.

You may only submit two requests to know within a 12-month period. Your requests to know or delete must:

• Provide enough information that allows us to reasonably verify you are the person we collected personal information about or an authorized representative.
• Be sufficiently detailed to allow us to properly understand, evaluate, and respond to it.

If we are unable to verify your identity or the authority of the request and confirm the personal information related to you, we will not be able to respond to your request or provide you with personal information.

You do not need to create an account with us here to submit requests to know or delete. We will only use the personal information provided in the request to verify the identity of the requester or the authority to make the request.

For instructions on exercising your right to opt out of the sale or opt-in rights, please see the Opting Out of Personal Information Sale and Opting In Rights.

(4) Response Time and Format

We will acknowledge receipt of your request within ten (10) business days. If you have not received acknowledgment within 10 days, please contact support@bfbsport.com.

We strive to substantively respond to verifiable consumer requests within forty-five (45) days of receipt. If we need more time (up to an additional 45 days), we will notify you in writing of the reasons and extension period.

If you have an account with us, we will provide a written response to that account. If you do not have an account with us, we will provide a written response by mail or electronically, at your choice.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. Our response will also explain the reasons we cannot comply with a request (if applicable). For data portability requests, we will select a format to provide your personal information that is easy to use and should allow you to transmit the information from one entity to another without hindrance.

We will not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you the reasons for this decision and provide you with a cost estimate before completing your request.

(5) Right to Opt Out of Personal Information Sale and Opt-In Rights

If you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time ("right to opt-out"). We do not sell the personal information of consumers we know to be 16 years old or younger. Consumers who opt in to personal information sales may opt out of future sales at any time.

To exercise the right to opt out, you (or your authorized representative) can submit a request to us by visiting our internet webpage (www.bfbsport.com)

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize the sale of personal information. However, you may change your mind and opt back in to personal information sales at any time by visiting our internet webpage (www.bfbsport.com):

You do not need to create an account with us here to exercise your right to opt out. We will only use personal information provided in an opt-out request to review and comply with the request.

(6) Non-Discrimination

We will not discriminate against you for exercising any rights. Unless permitted by applicable law, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you with a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

However, we may offer certain financial incentives permitted by applicable law (such as CCPA, CPRA) that can result in different prices, rates, or levels of quality. Any permitted financial incentives we offer will be reasonably related to the value of your personal information and will include written terms that describe the substantial aspects of the program. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Do Not Track: Certain web browsers transmit "Do Not Track" signals to websites. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they are even aware of them. We currently do not take action in response to these signals.

(7) Changes to the Privacy Policy

(7) Changes to the Privacy Policy

(8) Contact Information

For contact information, please refer to our privacy policy.