STARHEROES PRIVACY POLICY

I. Introduction

This Privacy Policy outlines how Web3 Software OÜ (16465008), headquartered in Tallinn, Estonia ("Company," "we," "our," or "us"), gathers and uses your personal information regarding your use of the Website and the Services.

This Privacy Policy comprises two sections:

1. Privacy Notice: This section presents how we gather and use your personal data.
2. Cookie Notice: This section presents the usage of cookies and like technologies.

We offer the Website and Services under the Terms&Conditions. Prior to accessing or using the Website and/or Services, please review the Terms&Conditions.

By using the Website or Services, you consent to the practices of data collection, usage, and disclosure outlined in this Privacy Policy, along with any other activities mentioned herein. In case you disagree with the terms of this Privacy Policy, kindly cease using the software and refrain from accessing the Website or Services promptly.

II. Definitions

Any terms not explicitly defined in this Privacy Policy carry the definitions provided in the Terms&Conditions. Please refer to that document for a clearer understanding of this Privacy Policy. Below are the meanings of the terms used in this Privacy Policy:

1. Applicable Data Protection Law – any applicable laws, statutes, regulations, orders, regulatory requirements, bylaws, and other similar legal instruments in force from time to time relating to data protection, data security, privacy, and/or the collection, use, disclosure and/or processing of Personal Data, including but not limited to the GDPR, local implementation of the ePrivacy Directive, or other EU or Member State law.
2. Controller, Personal Data, Processor, Processing, and other terms concerning personal data not specified herein shall have the meanings as defined in Article 4 of the General Data Protection Regulation (GDPR).
3. EEA – European Economic Area.
4. Company – Web3 Software OÜ registered and acting under the laws of Estonia, with registered number 16465008 and registered address at: Harju maakond, Tallinn, Nõmme linnaosa, Rännaku pst 12, 10917.
5. GDPR – General Data Protection Regulation 2016/679 of 27 April 2016.
6. ICT Systems – without limitation are all computer, communications, electronic, data processing or cloud systems used by the Company or you in relation to the use and/or provision of the Services under the Terms&Conditions.
7. Privacy Policy – this Privacy Policy.
8. Services – all services related to the Website, described in the Terms&Conditions.
9. Terms&Conditions – Terms&Conditions for the Website available at Terms of use.
10. Third-Party – an entity other than the Company or the Company affiliates that provides the Third-Party Services.
11. Third-Party Service – software or services provided by an entity other than the company or the Company affiliate that are linked to from the Website.
12. Website – the Website as defined in the Terms&Conditions.
13. Website Access Service – the Access to the Website service as defined in the Terms&Conditions.
14. you – the User as defined in the Terms&Conditions.

III. Changes

The Privacy Policy will undergo continuous review and updates as needed, such as for legal compliance or to align with changes in the Terms&Conditions. The present version of the Privacy Policy was accepted and became effective as of November 14 2024.

1. Controller

We, the Company, act as the controller of your personal data within the scope of this Privacy Policy.

We collaborate with StarHeroes DAO, a decentralized autonomous organization composed of StarHeroes community members actively involved in the development of the $STAR token.

We do not possess control over the blockchain networks or the wallet that you use. Additionally, we are not involved in any transactions conducted by you on the blockchain networks. We do not act as intermediaries, agents, advisors, or custodians in relation to any transactions carried out via the blockchain networks. What is more, we are not obliged to execute any orders or authorizations related to blockchain transactions. Apart from the information gathered in accordance with this Privacy Policy, we do not retain any data regarding Users, Users' identities, or services beyond what is publicly accessible or obtainable via the blockchain.

We might enlist the services of other entities to help us in processing your personal data as processors. In such instances, we retain responsibility for the usage of your personal data. However, there are cases where these entities may act as separate controllers of your personal data. Consequently, they bear responsibility for the use of your personal data. Further details regarding recipients of your personal data can be found in Section 7 of this Privacy Notice.

2. Contact

You can contact us by email at: legal@gameswift.io or in writing to our registered address: Harju maakond, Tallinn, Nõmme linnaosa, Rännaku pst 12, 10917.

3. Personal Data Sources

We gather your personal data solely in accordance with Applicable Data Protection Law and only to the extent necessary to fulfill our objectives (please refer to Section 5 of this Privacy Notice for details). The Website and Services are intended for individuals who are at least 18 years old. We do not knowingly collect personal data from individuals under the age of 18 in relation to the Website or Services. If you, as the User, are under 18 years old, you are prohibited from using or engaging with the Website or Services.

For ease of reference and to ensure clarity regarding this Privacy Policy, we've provided further explanation regarding the sources from which we collect your personal data below:

• You & your devices: We gather your personal data directly from you, such as when you input your information while interacting with the Website or Services. Additionally, we may collect personal data indirectly from your devices or software, such as your website browser.
• Third-Parties: We gather your personal data from Third-Parties, particularly in connection with your use of your cryptocurrency wallet. Our Web3 service providers might disclose certain information related to your interactions with blockchain networks and their services, which may include personal and/or anonymous data.
• Blockchain networks: In the process of delivering the Services, we gather personal and/or anonymous data from blockchain networks. This information encompasses publicly accessible on-chain information (which may constitute personal data) and limited off-chain technical information, such as device type, browser version, and similar data (typically anonymous).

4. Categories of Personal Data

We utilize your personal data exclusively in compliance with the Applicable Data Protection Laws and solely to the extent necessary to accomplish our objectives (please refer to Section 5 of this Privacy Notice for details). The following types of your personal data are collected and used in relation to your use of the Website and Services:

• Customer support data: Includes information gathered and used in association with the customer support services we provide, such as communications with us, surveys, questionnaires, or other requests.
• Technical data: Includes your IP address, details about your operating system, hardware specifications, and similar data. If such data can identify you, we handle it as personal data in accordance with the GDPR.
• Web3 data: Includes anonymous and, in some cases, personal data from blockchain interactions. This encompasses wallet addresses (when identifiable) and publicly accessible on-chain information.

5. Purposes and Legal Grounds of Processing

• Contract performance: We use personal data to fulfill contracts based on the Terms&Conditions (Article 6(1)(b) GDPR).
• Website Access Service: Personal data such as your IP address is used to facilitate access to the Website.
• Security: We process personal data to ensure the integrity and safety of our ICT systems (Article 6(1)(f) GDPR).
• Compliance: Personal data is used to adhere to legal obligations (Article 6(1)(c) GDPR).
• Legal rights: Data may be processed to establish, pursue, or defend legal claims (Article 6(1)(f) GDPR).

6. Data Storage

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. The duration of storage depends upon the purpose of processing. For example, we retain your personal data for the duration of providing you with the Services as per the agreement we've entered into with you, subject to the Terms&Conditions. Personal data processed based on legitimate interest(s), whether ours or those of a Third Party, is stored until you effectively object to such processing. Similarly, if we process your personal data based on your consent, we retain it until you withdraw your consent. Upon the conclusion of the data storage period, we permanently delete or anonymize your personal data.

The duration of storage or utilization of your data may be prolonged under specific circumstances. For instance, we might retain your personal data after the termination of the agreement with us if required by law. Additionally, we may continue to store and use the same dataset if we use it for a different purpose and on a different legal basis, provided it's permissible by law.

Please be aware that depending on the blockchain protocol, it may be technically unfeasible to delete or alter any information recorded on-chain in a public blockchain network due to the inherent characteristics of blockchain technology.

7. Data Recipients

As a standard practice, we refrain from sharing your personal data unless it is essential. For example, we might share your personal data in connection with the provision of the Services under the Terms&Conditions. We may disclose your personal data to the following categories of recipients:

• Data storage providers
• Web3 services providers (e.g., providers of wallets)
• Blockchain network participants
• External developers or software solution providers
• Affiliates, subsidiaries, or entities involved in mergers or acquisitions
• Public authorities (where required by law and subject to statutory limitations)
• Professional advisors, such as lawyers, accountants, and tax advisers

Please note that some of these partners act on our behalf as processors, while others operate as independent controllers of your personal data. We advise you to review their privacy policies and terms.

8. Data Transfers Outside the EEA

The level of protection for personal data outside the European Economic Area (EEA) may vary. Therefore, we only transfer your personal data outside the EEA when necessary and with an adequate level of protection. This is primarily achieved by collaborating with processors of personal data in countries where the European Commission has determined an adequate level of protection. We may also use standard contractual clauses issued by the European Commission.

9. Requirement to Provide Personal Data

In certain instances, the provision of your personal data is mandatory by law or essential to fulfill your request or to execute a contract with you. Failure to provide this data may result in our inability to fulfill your request or execute the contract.

In other instances, providing your personal data is voluntary. If you choose not to provide your personal data, we may be unable to fulfill your request or achieve our objectives.

10. Your Rights

Depending on your location, you may have different privacy rights. Under the GDPR, you are entitled to the following rights:

• Right to access information: Request information about your personal data and a copy of it.
• Right to correct your data: Request rectification of inaccurate data or completion of incomplete data.
• Right to be forgotten: Request erasure of your personal data under certain conditions.
• Right to restrict: Request that we cease processing your personal data under specific conditions.
• Right to data portability: Request transfer of your data to another controller in a machine-readable format.
• Right to withdraw consent: Withdraw your consent to processing at any time.
• Right to object: Object to the processing of your data based on legitimate interests.
• Right to lodge a complaint: File a complaint with your local data protection authority or the Estonian Data Protection Inspectorate.

1. What are cookies?

Cookies are small text files installed on your device that collect information, typically to enhance the usability of the Website and the Services. For example, cookies may remember your language preferences or other settings of your Internet browser. Most often, the information utilized in connection with cookies constitutes personal data and the Privacy Notice applies to such personal data.

2. What cookies are used?

The subsequent types of cookies are used in connection with your use of the Website and the Services.

• Necessary cookies: Necessary cookies are essential for the proper functioning of the Website and the Services. For instance, these cookies enable basic features such as page navigation. These cookies are obligatory because they're essential for providing the Website and its Services.

3. How long are the cookies used?

The duration for which cookies are used varies depending on their type and purpose. As a rule, there are two main types of cookies: session cookies and persistent cookies.

• Session cookies: These expire at the end of a specific session.
• Persistent cookies: These are stored on your device for a longer duration and do not expire at the end of a session.

Our cookies expire within a maximum period of 12 (twelve) months.

4. Your rights

You may manage cookies via your Internet browser, such as by removing some or all cookies from your device or by blocking them. However, this action only affects cookies used in connection with the Website or the Services accessible online through your Internet browser.

Please be aware that managing cookies in this manner may result in the Website or the Services not functioning properly or not functioning at all. To manage cookies through your Internet browser, refer to the instructions provided by the browser provider. For instance, you can find instructions for relevant Internet browsers on the websites of their developers:

• Microsoft (Internet Explorer, Edge)
• Google (Chrome)
• Apple (Safari)
• Mozilla (Firefox)
• Opera (Opera)

If in connection with cookies your personal data is used, you have the rights outlined in the Privacy Notice, and you can act upon them accordingly. Refer to Section 10 of the Privacy Notice for further information.