PRIVACY POLICY

The Xplay Platform is offered and operated by Ludium Lab S.L., c/ Llauder 1, ent - 1A, 08003, Barcelona, Spain, contact email: contact@xplay.accesstwine.com (hereinafter “Xplay” or “we”) in its own responsibility, but for ACCESS Europe GmbH, Essener Str. 2-24, 46047 Oberhausen, Germany.

1. Introduction

At Xplay we want to provide you with the best possible experience to ensure that you enjoy our service today, tomorrow and in the future. In order to do so, we need to know your gaming habits, so that we can offer you an exceptional and personalized service.

Having said that, the privacy and security of your personal data is of great importance to us. For this reason, we want to clearly explain how and why we collect, store, share and use your personal data, and show you the controls and options available for you to choose when and how you share your personal data.

That is our goal and we will explain it in more detail in this Privacy Policy ("Policy”).

2. About this Policy

This Policy provides essential information regarding the use that Xplay makes of your personal data. The Policy applies to all Xplay services and associated services (hereinafter the "Xplay Service"). The terms governing the use of the Xplay Service are defined in our Terms of Use and EULA (the "Terms of Use").

Regularly, we may develop new services or offer additional services. If the introduction of these new or additional services generates any kind of change in the way we collect or process your personal data, we will provide you with more information and additional conditions or policies. Unless otherwise indicated, when these new or additional services are introduced, they will be subject to this Policy.

The main goal of this Policy is:

Ensure that you understand what personal data we collect about you, the reasons why we do so, and with whom we share it;
Explain the way in which we use the personal data that you share with us in order to control, manage and ensure the functionality of the Xplay Service when you use it; and
Explain your rights and options regarding the personal data we collect and process about you and how we will protect your privacy.

We hope this helps to understand our commitment to your privacy.

If you have any questions or comments related to the processing of your data, you can send an email to contact@xplay.accesstwine.com. If you do not agree with the content of this Policy, remember that you decide if you want to use the Xplay Service.

3. Who is responsible for processing the data on the Xplay?

Ludium Lab S.L., c/ Llauder 1, ent - 1A, 08003, Barcelona, Spain, the operator of Xplay, is the data controller for the collection, processing and use of personal data in connection with Xplay.

4. Your rights and preferences: options and control

As you may already know, the new European Union regulation known as the General Data Protection Regulation (“GDPR”) gives people certain rights related to their personal data.

The rights granted to people are:

Right of access: the right to be informed and request access to the personal data we process;
Right to rectification: the right to request that we correct or update your personal data, when they are inaccurate or incomplete;
Right to erasure: the right to request that your personal data be deleted;
Right to restriction of processing: the right to request that the processing of all or some of your personal data be temporarily or permanently stopped;
Right of opposition
- the right, at any time, to object to the processing of your personal data for reasons related to your particular situation;
- the right to object to your personal data being processed for direct marketing purposes;
Right to data portability: the right to request a copy of your personal data in electronic format and the right to transmit such data for use in the service of a third party;
Right not to be subject to automated individual decision-making: the right not to be subject to decisions based solely on automated decision-making, including profiling, when the decision may have a legal effect on you or produce a similar significant effect.
Right to revoke at any time the consent granted through the Privacy Settings panel.

In order to allow you to easily exercise these rights and record your preferences regarding how Xplay uses your personal data, we will provide you with access to the following settings through the Account Settings page:

Privacy settings: it allows you to control some of the categories of personal data that we process and it allows you to access your personal data, change your avatar, as well as consent or revoke your consent regarding the commercial communications that you may receive from Xplay.

You can contact us at our address given above, or you can contact us through contact@xplay.accesstwine.com, Ref: Data Protection, to exercise your rights. You must indicate the rights you want to exercise and prove your identity as an applicant when appropriate.

5. How do we collect your personal data?

We collect your personal data as follows:

Checking in to Xplay Service: When you register to create an account in the Xplay Service, we collect certain personal data so you can use the Xplay Service, such as an email and, afterwards, an username (alias) and coarse birth date (i.e. month and year). In those plans that require payment for their use, the data regarding the payment method is also collected and, therefore, the payment platform that uses the Xplay Service ensures its correct protection.
Use of the Xplay Service: when you use the Xplay Service, we collect personal data about the use of the Xplay Service, such as what games you have played, when you have done it and how long have you been playing each one, as well as what games have been selected as favorites from the Xplay Service catalog. Each game has a classification of the minimum age that the user must be to be able to access and play the game. This classification is determined by the official classification, known as Pan European Game Information (“PEGI”), which establishes the appropriate minimum age to play video games according to their category. The PEGI has the purpose of guiding the consumer about the suitability of playing a specific game through the minimum age recommended by the PEGI. Therefore, when collecting data about the games the user plays, we can also collect PEGI data.
Collect personal data that allows us to provide you with additional features / functionalities: from time to time, we also offer you the possibility to provide us with additional personal data or to give us your permission to collect it; for instance, to provide you with more features or functionality.

We use anonymous and additional information for purposes that include testing our computer systems, research, data analysis, marketing and promotion modeling, improving the Xplay Service, and developing new functionality and features within the Xplay Service. However, since the data is anonymised, it dissociates itself from the person who owns the data, preventing its identification.

6. How and what personal data do we collect from you?

We have established in the tables below the categories of personal data that we collect and use about you:

Personal data collected when you register with the Xplay Service

Personal data Categories	Category description
Check-in data	It consists of the personal data that you provide or we collect to enable you to register and use the Xplay Service. This includes your username, for the Xplay Service, coarse birth date (i.e. month and year), and your email. At the same time, in order to record the acceptance by the user of the privacy policy and the terms and conditions of the Xplay Service, we will register the email and the exact time (i.e. timestamp) in which the user has accepted it. The personal data that we request is necessary to create your account. However, you have the option to provide us with additional personal data in order to further personalize your account such as an image or avatar. The exact personal data that we collect may vary depending on the type of Xplay Service plan that you have subscribed.

Personal data Categories

Category description

Check-in data

It consists of the personal data that you provide or we collect to enable you to register and use the Xplay Service. This includes your username, for the Xplay Service, coarse birth date (i.e. month and year), and your email. At the same time, in order to record the acceptance by the user of the privacy policy and the terms and conditions of the Xplay Service, we will register the email and the exact time (i.e. timestamp) in which the user has accepted it.

The personal data that we request is necessary to create your account. However, you have the option to provide us with additional personal data in order to further personalize your account such as an image or avatar.

The exact personal data that we collect may vary depending on the type of Xplay Service plan that you have subscribed.

Personal data collected through your use of the Xplay Service

Personal data Categories	Category description
Xplay Service usage data	These are the personal data collected when you use the Xplay Service, and may include: Information about your type of Xplay Service plan. Information about your interactions with the Xplay Service, including the date and time of any requests you make and the games you have played and the games you have chosen as favorites. Messages you send and/or receive through Xplay and your interactions with the Xplay Customer Service team. Technical data that may include URL information, cookies data, your IP address, the unique device ID (to prevent undesired usage of the service) and the types of devices you use to access or connect to the Xplay Service, device attributes, device and network performance, the type of browser (if you access from a web browser), the preferred language, Device Firebase Registration token (used to push messages to the app), the country you are connecting from, the information that allows the management of digital rights, operating system and version of the Xplay application. You can find more information about the technical data that we process when you access from a web browser in our Cookies Policy.
Age	In the registration process, the user's age is requested in order to determine if he/she is a child and to activate the parental acceptance process and propose the games to the user within the informed age range with the recommendations of each video game based on their corresponding PEGI, which is a European system for classifying the content of video games and other types of entertainment software based on the users age.

Personal data Categories

Category description

Xplay Service usage data

These are the personal data collected when you use the Xplay Service, and may include:

Information about your type of Xplay Service plan.
Information about your interactions with the Xplay Service, including the date and time of any requests you make and the games you have played and the games you have chosen as favorites.
Messages you send and/or receive through Xplay and your interactions with the Xplay Customer Service team.
Technical data that may include URL information, cookies data, your IP address, the unique device ID (to prevent undesired usage of the service) and the types of devices you use to access or connect to the Xplay Service, device attributes, device and network performance, the type of browser (if you access from a web browser), the preferred language, Device Firebase Registration token (used to push messages to the app), the country you are connecting from, the information that allows the management of digital rights, operating system and version of the Xplay application. You can find more information about the technical data that we process when you access from a web browser in our Cookies Policy.

Age

In the registration process, the user's age is requested in order to determine if he/she is a child and to activate the parental acceptance process and propose the games to the user within the informed age range with the recommendations of each video game based on their corresponding PEGI, which is a European system for classifying the content of video games and other types of entertainment software based on the users age.

Personal data collected with your consent to enable us to provide you with additional features or functionality

Personal data Categories	Category description
Location data	Please note that we DO NOT access your GPS or Bluetooth to get the exact location of your mobile device. We use Google APIs to identify the country from the device is connected to validate the correct access and usage of the Xplay service. For instance, the country or city where you are, to comply with our license agreements, offer features, information, advertising or any other content based on your location and use of the service. Besides, we use your IP address to ease the analysis to solve issues and validate the correct usage of the service.
Payment data	The personal data collected for the payment method will go directly to the payment platform used and therefore, the payment platform will be responsible for its correct management and protection. The exact personal data will vary depending on the payment method (for instance, directly through your mobile operator or by invoice), but may include information such as: Name and surname; Postal Code; Payment method, credit card or debit If you decide to request an invoice, we will provide your personal data to our payment processors in order to carry out a credit check so that you can have the invoices you require
Contests, raffles and survey data	This personal data is used to allow you to register and participate in these types of promotions. The exact personal data collected will vary depending on the promotion. Such personal information is used to allow Xplay to send you marketing communications via email and push notifications.
Marketing data	Such personal information is used to allow Xplay to offer games and other initiatives through the app alerts.
Google Play transaction	We collect information related to Purchases history including: Purchased subscription Purchase sources (Play Store or other future ones) Play Store purchase token: Used to uniquely ID a purchase on the store Play Store order ID Play Store country Paid price and currency Payment state: To determine if the purchase has been paid or not, before executing a game Subscription state PromotionCode: Determines if the user benefited from a promo Cancelation reason and user comments Start and Expire time of the subscription

7. For what purpose do we use your personal data?

When you use or interact with the Xplay Service, we use different technologies to process your personal data for various reasons. The following table shows the purposes of the processing of your personal data, the associated legal bases which allows us to process your personal data, and the categories of personal data (identified in section 5 " How and what personal data do we collect from you?") used for the following purposes:

Description of why Xplay processes your personal data ("processing purpose")	Legal basis for the processing purpose	Categories of personal data used by Xplay for the processing purpose
Provide and customize the functionality of the Xplay Service according to the user.	Performance of Contract Consent	Account registration data Service usage data PEGI acceptance data of the video game
To understand the use of the Xplay Service to improve the functionality of the service, develop new products and services provided by Xplay, and analyze its use.	Consent and acceptance of this Privacy Policy, Cookies Policy and Terms of Use of the Xplay Service.	Service usage data
To offer the user functions, information, recommendations, advertising or any other content based on their use of the service, including its location.	Consent	Service usage data Location data
To understand the use of the service to ensure the technical functionality of the Xplay Service.	Performance of contract Legitimate interests	Account registration data Service usage data PEGI acceptance data of the video game
To communicate with you for purposes related to the Xplay Service.	Performance of contract	Account registration data Service usage data
To validate your payment to prevent or detect fraud, including fraudulent payments and fraudulent use of the Xplay Service, and manage billing services.	Performance of contract To comply with legal obligations	Payment data
To communicate with you regarding your participation in surveys, contests, raffles and promotions.	Consent	Contests, raffles and survey data Marketing data

8. Shared use of your personal data

This Section introduces the different categories of the recipients of the personal data collected or generated through your use of the Xplay Service.

Publicly available information

The following personal data will always be publicly available on the Xplay Service: Avatar and username that will be shared with other Xplay users who use the service.

Information that we can share

Recipient Category	Sharing purpose
Service providers and other collaborators	We use technical service providers that procure the technical infrastructure we need to provide the Xplay Service, in particular the providers that host, store, manage and maintain the Xplay application, its content and the data we process. We use technical service providers to help us communicate with you, as described in Section 6 of this Policy, among others, for the resolution of technical incidents that may lead to an exchange of questions-answers-technical data that we may need in order to resolve the incident. We use marketing and advertising partners to display more personalized content, or to help us understand your use of the Xplay Service provide you with a better service. We may also share personal data with some marketing or advertising partners or providers in order to send you promotional communications about Xplay. We may also share your personal data in a pseudonymized format with our industry partners to help them understand how activities and games work on Xplay. Similarly, we share your personal data in a pseudonymized format with marketing partners who help us with promotional activities, and with advertisers who allow us to offer a free service.
Academic researchers	We will share your personal data for activities such as statistical analysis and academic study, but only in a pseudo-anonymised format.
Other trading companies	We will share your personal data with other companies with which there are marketing agreements to carry out our daily business operations and to enable us to maintain and provide the Xplay Service.
Compliance with the law and data protection authorities	We will share your personal data in order to comply with a legal obligation under applicable law, or to respond to a valid legal process, such as a search warrant, court order, or subpoena. We may also share your personal data when we believe in good faith that it is necessary for our own interest or the legitimate interest of third parties related to national security, law enforcement, lawsuits, criminal investigation, protection of the safety of any person, or avoid imminent death or bodily harm, provided that we consider that such interest is not overridden by your interests or the fundamental rights and freedoms that require the protection of your personal data.

9. Data retention and erasure

We retain your personal data only for the time necessary to provide the Xplay Service and for legitimate and essential business purposes, such as maintaining the performance of the Xplay Service, making data-driven business decisions about new features and offerings, complying with our legal obligations and resolving disputes. We retain some of your personal data while you are a user of the Xplay Service.

Upon request, we may delete or anonymize your personal data so that you are not identified, unless, we can or are legally required to retain certain personal data, including the following cases:

If there is an unresolved issue related to your account, such as pending payments on your account or an unresolved claim or dispute, we will retain the necessary personal data until such issue is resolved;
When we are obliged to retain personal data to comply with our legal, tax, accounting and auditing obligations, we will keep the necessary personal data for the period required by applicable law; and/or
When necessary for our legitimate business interests, such as fraud prevention or maintaining the security of our users.

10. Transfer to other countries

Xplay does not share your personal data with other companies located outside the territory of the EU.

11. Links

We may display third party advertisements and other content linked to third party websites. We cannot control or be responsible for the privacy practices and content of third parties. If you click on a third-party advertisement or link, you understand that you are leaving the Xplay Service and any personal information you provide will not be covered by this Policy. Please read the privacy policies of the third parties responsible for the website you access to find out how they collect and process your personal data.

12. Protection of your personal data

We are committed to protect the personal data of our users. We implement the appropriate technical and organizational measures to help protect the security of your personal data. However, keep in mind that no system is completely secure. We have implemented various policies including pseudonymization, encryption, access and retention policies to protect against unauthorized access and unnecessary retention of personal data on our systems.

The password protects your user account, so we recommend that you use a unique and firm password, to limit access to your computer and browser, and log out after using the Xplay Service.

13. Conditions applicable to child's consent in relation to Xplay

Pursuant to the GDPR the processing of a child's personal data is lawful when the child is at least 16 years old. If the child is under 16 years of age, such process shall only be considered lawful if and only to the extent that consent was given or authorized by the holder of parental authority or guardianship over the child. Member States may provide by law for a lower age for such purposes, provided that it is not less than 13 years. In the case of Spain it is set at 14 years. Xplay will make reasonable efforts to verify that consent was given or authorized by the holder of parental or guardianship over the child, taking into account available technology.

In case you have any doubt or comment regarding Xplay's parental control process or you want to inform us about any aspect related to a child, you can do it by email (using the email contact@xplay.accesstwine.com). Xplay will act with total confidentiality in the analysis of the information provided.

14. Avatar or Profile Picture

We inform you that if you add your own image as a profile picture, it will be public and any person or user will be able to access and view it. To configure the Privacy of the profile picture you have chosen, you must access the Profile Settings.

15. Changes to this Privacy Policy

Occasionally, we may make changes to this Policy. If we make material changes, we will provide you with a prominent notice under the circumstances, for example, by displaying one in the Xplay Service or by sending you an email. We can notify you in advance.

Therefore, be sure to read any notification carefully.

16. How to contact us

If you have any questions about this Policy, please contact our Data Protection Officer by email to contact@xplay.accesstwine.com or by writing at the following address:

Ludium Lab, S.L
c/ Llauder 1, ent - 1A,
PC 08003
Barcelona, Spain