DUCK × MY × DUCK Privacy Policy

1. INTRODUCTION AND SCOPE

This Privacy Policy explains how DUCKY DUCK LTD, operating the DUCK × MY × DUCK / Ducky Duck game and related services ("DUCK × MY × DUCK", "Ducky Duck", "we", "us", or "our"), collects, uses, stores, discloses and otherwise processes personal data in connection with the game and related services. It applies to the Telegram-based version of the game, including any DUCK × MY × DUCK bot or Mini App made available through Telegram, the Ducky Duck mobile application distributed through Google Play and the Apple App Store, and any related features, applications, software or services made available by or on behalf of DUCKY DUCK LTD (collectively, the "Services").

The Ducky Duck mobile application may be published and distributed through Google Play and the Apple App Store by Limited Liability Partnership "KowiyGames", BIN 221040032392, address: Kazakhstan, Almaty city, Bostandyk district, Auezova st. 175, n.p. 9a, postal code 050057 (the "Mobile Publisher"), pursuant to a mobile publishing licence granted by DUCKY DUCK LTD. The Mobile Publisher may perform mobile distribution, store-account administration, first-line customer support, transaction and entitlement administration, and other platform-related operational functions in connection with the mobile application, as further described in this Privacy Policy. For the avoidance of doubt, the Mobile Publisher's role described in this Privacy Policy is limited to the mobile application distributed through Google Play and/or the Apple App Store. The Mobile Publisher does not publish, distribute, operate, monetize, market, advertise or promote the Telegram-based version and does not process personal data in connection with Telegram Stars transactions, Telegram-specific entitlements, refunds or platform administration merely by virtue of acting as the Mobile Publisher.

The Telegram-based version and the mobile application are different access points to the same game service. When a User registers, signs in to or otherwise accesses the mobile application, we may determine whether an existing DUCK × MY × DUCK Account previously used through the Telegram-based version (an "existing Telegram-linked Account") may be associated with that User. Where a potentially matching existing Telegram-linked Account is identified, the Services may offer the User a choice either to link or synchronize that Account with the mobile application or to create and use a separate new mobile Account. If the User chooses synchronization, the same underlying server-side Account, character, Items, In-Game Currency, resources, entitlements and game progress may be made available through both supported access points. If the User declines synchronization, the existing Telegram-linked Account and the new mobile Account remain separate and maintain separate Account-specific data and progress; declining synchronization does not by itself delete, terminate, reset or otherwise modify the existing Telegram-linked Account.

This Privacy Policy should be read together with the DUCK × MY × DUCK / Ducky Duck Terms of Use. Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms of Use. By downloading, installing, accessing or using the Services, you acknowledge the processing practices described in this Privacy Policy. Where the Services present a checkbox or other affirmative control asking you to acknowledge that you have reviewed the current Privacy Policy, that acknowledgement confirms that the current privacy notice has been made available to you. Where applicable law requires consent for a particular processing activity, we will request that consent separately.

From the time this version of the Privacy Policy becomes applicable to you and, where the Services require it, you acknowledge having reviewed it, this version supersedes and replaces all prior privacy policies or privacy notices issued or presented by DUCKY DUCK LTD under the DUCK × MY × DUCK or Ducky Duck name in connection with the Services for processing occurring from that time onward. Prior versions do not continue to govern future processing merely because they were previously presented or acknowledged.

This Privacy Policy does not govern personal data collected independently by Telegram, Google, Apple, digital-wallet providers, blockchain networks or other third-party services. Telegram independently processes personal data in connection with the Telegram platform, Telegram accounts, Telegram Stars and other Telegram functionality under its own applicable privacy notices, terms and platform rules. This Privacy Policy applies only to personal data processed by or on behalf of DUCKY DUCK LTD as described herein. Where a User independently chooses to use a third-party marketplace or similar service outside the Services, that third party processes personal data under its own privacy notice and terms.

2. DATA CONTROLLER AND PRIVACY CONTACT

DUCKY DUCK LTD, a private company limited by shares incorporated in the Republic of Cyprus under the Companies Law, Cap. 113, registration no. HE 496948, with registered office at Anastasiou Sioukri, 1, THEMIS COURT, 4th floor, Flat/Office 402, 3105 Limassol, Cyprus, operates the Services under the DUCK × MY × DUCK and Ducky Duck names and is the data controller responsible for determining the purposes and means of the processing of personal data described in this Privacy Policy. Under other applicable privacy laws, DUCKY DUCK LTD may also be referred to as the operator or business responsible for the relevant personal data. We recognize our responsibilities under applicable data protection and privacy laws, including, where applicable, Regulation (EU) 2016/679 (the "GDPR").

DUCKY DUCK LTD remains the controller for the Game Account, gameplay, service-operation and other personal data for which it determines the purposes and means of processing. In connection with mobile publication, the Mobile Publisher may process limited personal data relating to distribution, platform operations, first-line support, transactions, entitlements, analytics, fraud prevention and compliance. Depending on the specific processing activity and the Parties' actual allocation of functions, the Mobile Publisher may act as a processor or service provider acting on documented instructions from DUCKY DUCK LTD, or as a separate controller where it independently determines the purposes and means of processing data received or maintained through its own developer, payment or platform accounts or for its own legal, accounting, security or platform-compliance obligations. Where the Parties jointly determine the purposes and means of a particular processing activity, they will comply with any applicable joint-controller requirements. The Mobile Publisher's registered contact address is the address stated above; for convenience, Users may submit privacy, account or support requests through the DUCKY DUCK LTD contact channels below, and we may coordinate or route the request to the Mobile Publisher where necessary. Account linking or synchronization between an existing Telegram-linked Account and the mobile application does not, by itself, make the Mobile Publisher a controller or processor in relation to the operation of the Telegram-based version. Any processing by the Mobile Publisher remains limited to the mobile-publishing, Platform, support, transaction, entitlement, security or compliance functions for which the Mobile Publisher actually processes personal data as described in this Privacy Policy.

For privacy and data protection questions, complaints, and requests to exercise your privacy rights, you may contact us at [email protected]. For general account, technical and customer-support matters, including assistance with account deletion, you may contact us at [email protected]. You may also use the official DUCK × MY × DUCK support mechanism made available within the Services or the official DUCK × MY × DUCK Telegram support channel. We may request information reasonably necessary to verify that the request relates to your account and to protect Users against unauthorized access or deletion requests.

The email addresses above are designated contact points for the purposes described in this Privacy Policy. A request received through one contact point may be routed internally to the appropriate team where necessary to handle the request properly. Any such internal routing does not affect response periods required by applicable law.

3. PERSONAL DATA WE PROCESS

We seek to collect and process only personal data that is relevant and reasonably necessary for the purposes described in this Privacy Policy. The categories below describe the data currently contemplated by the Services and the DUCK × MY × DUCK / Ducky Duck Terms of Use. The exact data processed depends on the features you use.

3.1. Authentication and Account-Matching Data

If you access DUCK × MY × DUCK through Telegram, or sign in to the mobile application using Telegram, Telegram may make an encoded authentication object and related account information available to us. This may include your Telegram user ID and, where available, your Telegram username and/or name. Based on the current account-matching flow, we do not use a Telegram phone number for this purpose.

If you register or sign in to the mobile application using another supported authentication method, such as an email address or a supported Apple or Google authentication method, we may receive or process the email address, provider-specific user identifier, authentication information or other account identifier made available through the relevant sign-in process.

We may use such identifiers, together with information already associated with our existing game Accounts, to determine whether a potentially matching existing Telegram-linked Account may be associated with you and, where appropriate, to offer you the Account-linking, synchronization or progress-transfer choices described in the Terms of Use.

Identifying a potential match does not by itself merge, link or synchronize Accounts or transfer game progress. Linking or synchronization occurs only where the applicable Account-linking functionality is used and you select the synchronization option presented through the Services. If you decline synchronization and create a separate new mobile Account, we do not transfer or duplicate Account-specific character data, progress, Items, In-Game Currency, resources or entitlements from the existing Telegram-linked Account to the new mobile Account solely because matching or similar identifiers have been identified.

3.2. Game Account, Character and Progress Data

We process information associated with your DUCK × MY × DUCK game Account, including internal account identifiers, character information, game progress, in-game inventory and entitlements, account status, Account-linking or synchronization status, records of your Account-configuration selection where reasonably necessary to implement or document that selection, and other records necessary to provide the game through supported access points. Where an existing Telegram-linked Account is successfully linked or synchronized with the mobile application, the supported access points may use the same underlying server-side Account data rather than separate copies. Where you decline synchronization and create a separate mobile Account, the existing Telegram-linked Account and the new mobile Account maintain separate Account-specific data and game progress unless the Services expressly provide otherwise.

3.3. Technical, Device, Access and Security Data

We process technical authentication, device, application, access and security information generated or made available when you use the Services to the extent reasonably necessary to authenticate Users, operate and maintain the Services, deliver requested functionality, diagnose technical issues, protect account and system security, prevent fraud and abuse, enforce geographic or technical restrictions, and investigate suspected violations of the Terms of Use. Depending on the access point, device, platform and feature used, this information may include IP address and network connection information, access timestamps, device type or model, operating-system type and version, Telegram client, browser or WebView environment information where applicable, application version, language or similar device settings, device or application identifiers used for service operation, push-notification tokens where notifications are enabled, crash reports, diagnostic and performance logs, security events and related technical metadata. We may infer an approximate country or region from network or platform information where reasonably necessary for availability, security, fraud-prevention or legal-compliance purposes. We do not use this information for a materially different purpose without providing any notice or obtaining any consent required by applicable law.

3.4. Digital Wallet and Blockchain-Related Data

Certain features may require you to connect a compatible digital wallet or interact with an NFT made available through or in connection with the Services. In that context, we may process wallet addresses, wallet-related identifiers, transaction references, public keys where relevant, and publicly available blockchain information to the extent necessary to verify ownership or eligibility, enable or support NFT-related gameplay features, process the minting, withdrawal or extraction of NFTs, provide support, and prevent fraud or abuse. A wallet address, transaction identifier, public key or other blockchain metadata may constitute personal data where it is linked or reasonably capable of being linked to you or your Account. When you request an NFT-related blockchain transaction, information technically necessary for that transaction may be submitted to the relevant public blockchain network. Information recorded on a public blockchain may be visible to an indefinite number of network participants and other persons, may be replicated by nodes located in multiple countries, and may remain publicly available independently of DUCK × MY × DUCK. We seek to avoid placing Account names, Telegram identifiers, support communications, identity-verification materials or other directly identifying personal data on a public blockchain where those data are not technically necessary for the requested NFT functionality or for proper gameplay functionality. DUCK × MY × DUCK does not provide or operate functionality that enables Users to trade or exchange NFTs with one another within the Services. Any sale, purchase, transfer or exchange of an NFT through an external wallet, marketplace or other third-party service takes place outside the Services and is governed by the terms and privacy practices of the relevant third party. Public blockchain records may be immutable and may remain publicly available even after an Account is closed or an erasure request is fulfilled with respect to data controlled by DUCK × MY × DUCK.

3.5. Purchases and Transaction Information

Purchases and payment processing may be handled through the platform or payment mechanism applicable to the relevant version of the Services. In the Telegram-based version, purchases of digital goods or digital services are made using Telegram Stars in accordance with applicable Telegram rules. Telegram processes the acquisition and platform-level use of Telegram Stars under its own terms and privacy practices. We may receive or process limited information relating to a Telegram Stars transaction, such as a transaction confirmation or identifier, the amount or transaction status, the Item, entitlement or other digital content associated with the transaction, and refund, reversal or payment-support information, to the extent made available to us and reasonably necessary to deliver the purchased content, maintain Account entitlements, provide support, prevent fraud or abuse, administer refunds or comply with applicable law. For purchases made through the mobile application, payment and app-store processing may be performed through Google Play, the Apple App Store or another payment provider made available for the mobile application. We do not need to receive or store your full payment-card number in order for those providers to process a transaction. We may receive transaction confirmations, entitlement information, transaction identifiers or other limited purchase information made available by the relevant provider to the extent necessary to provide the purchased Item or feature, maintain records, prevent fraud, respond to support requests, or comply with law. Where made available by the relevant provider, we may also receive information indicating that a transaction was refunded, reversed, charged back, cancelled or otherwise voided, together with limited status or reason information, and may process relevant entitlement, Account and usage records to adjust affected entitlements, investigate suspected refund or chargeback abuse, resolve disputes and comply with applicable law. For purchases made through the mobile application, the Mobile Publisher may operate the relevant app-store developer, payment or settlement accounts and may receive transaction, settlement, entitlement, refund, chargeback and related limited information through those accounts. The Mobile Publisher may make relevant information available to DUCKY DUCK LTD where reasonably necessary to deliver purchased content, maintain Account entitlements, provide support, prevent fraud or abuse, administer refunds or chargebacks, reconcile payments or comply with applicable law and Platform requirements. The Mobile Publisher's transaction and payment-related processing described in this Section relates only to the mobile application. The Mobile Publisher does not receive or process Telegram Stars transaction information on behalf of the Telegram-based version merely by virtue of its role as Mobile Publisher.

3.6. User Content, Communications and Support Information

If you submit profile information, User Content, questions, comments, feedback, support requests, complaints, reports or other communications through the Services or our official channels, we process the information you choose to provide and information reasonably necessary to respond, moderate the Services, investigate reports, enforce the Terms of Use and maintain support records. First-line support for the mobile application may be performed by the Mobile Publisher or a support team acting for the Company and/or the Mobile Publisher. Support communications and related Account, technical, transaction or entitlement information may be routed between the Mobile Publisher and DUCKY DUCK LTD where reasonably necessary to resolve the request, investigate an issue, provide second-line technical support, enforce the Terms of Use or comply with law.

3.7. Anti-Abuse and Verification Information

The Terms of Use permit anti-bot, anti-fraud, anti-abuse, Exploit-abuse, refund-abuse, chargeback-abuse and multi-account checks. Where a verification or review process is triggered, we may process records relating to suspicious activity, including suspected bots, Exploit abuse, unusual or repeated refund or chargeback activity, transaction and entitlement history, use or consumption of purchased content or value, prohibited multi-account activity, and other information reasonably necessary to investigate whether conduct involving an Account, purchase, refund, chargeback, NFT withdrawal or payment dispute involves fraud or abuse. In disputed or higher-risk cases, we may also process verification materials that you provide. We use such materials only for verification, security, fraud and abuse prevention, dispute resolution, enforcement and compliance purposes, subject to applicable law. DUCK × MY × DUCK does not use biometric identification or facial-recognition technology and does not create biometric templates from verification videos, photographs or identity-confirmation materials. Verification materials may be reviewed by authorized personnel or service providers where reasonably necessary for the stated purposes.

4. SOURCES OF PERSONAL DATA

Depending on how you use the Services, we obtain personal data from the following sources:

▪ directly from you, including information you submit through the game, support channels, verification processes or connected-wallet features;

▪ from Telegram when you access the Telegram-based version, authenticate using Telegram or where Telegram makes supported account identifiers available through an authentication process;

▪ from supported authentication providers or sign-in methods, including, where applicable, Apple, Google or an email-based authentication service, when you choose to use the relevant authentication method and the provider or process makes account or authentication identifiers available to us;

▪ from Telegram, where Telegram makes information relating to Telegram Stars transactions, transaction status, refunds or related support matters available to us;

▪ from Google Play, the Apple App Store and other supported payment providers in connection with purchases through the mobile application;

▪ from supported wallet providers, blockchain networks and blockchain-related service providers where you connect a wallet, mint, withdraw or otherwise use an NFT-related blockchain feature;

▪ from the Mobile Publisher and the Mobile Publisher's developer, payment, analytics, customer-support or other Publisher Accounts where they make support, platform, transaction, entitlement, analytics, refund, chargeback or other operational information relating to the mobile application available to us;

▪ from our existing Account records where reasonably necessary to determine whether identifiers associated with a mobile sign-in may correspond to an existing Telegram-linked Account;

▪ from public blockchain networks, where you use NFT-related blockchain features; and

▪ from your device, operating system, Telegram client, browser or WebView environment where applicable, application environment and our own systems when technical, device, account, progress, authentication, diagnostic, security, anti-fraud, push-notification or support records are generated through your use of the Services.

5. HOW WE USE PERSONAL DATA

We may use personal data for the following purposes, as applicable to the features you use:

▪ to create, authenticate, identify and maintain your DUCK × MY × DUCK account;

▪ to identify whether a potentially matching existing Telegram-linked Account may be associated with a User registering or signing in to the mobile application and, where applicable, to present the available Account-linking, synchronization or progress-transfer choice;

▪ to implement the Account configuration selected by the User, including making the same underlying Account data and progress available through linked access points where synchronization is selected, or maintaining a separate mobile Account and separate game progress where synchronization is declined;

▪ to operate, maintain, configure and improve the Services and gameplay experience, diagnose crashes and technical problems, and maintain compatibility, performance and reliability;

▪ to provide, display, verify, enable or otherwise support the in-game use of NFTs, Items, entitlements and related gameplay features;

▪ to process or confirm purchases made using Telegram Stars in the Telegram-based version, deliver corresponding Items or entitlements, administer permitted refunds or reversals, provide payment support and maintain appropriate transaction records;

▪ to process or support purchases made through Google Play, the Apple App Store or other supported payment providers in connection with the mobile application;

▪ to enable, verify and support wallet connections and the minting, withdrawal, extraction or other supported use of NFTs;

▪ to coordinate mobile distribution, store-account administration, first-line customer support, transaction and entitlement administration, refunds and chargebacks, fraud prevention, analytics reasonably necessary for mobile publishing, and Platform or legal compliance with the Mobile Publisher, solely in connection with the mobile application;

▪ to provide customer support, respond to requests, administer promotions or features, and communicate important service information;

▪ to deliver push notifications or other device-level service communications where enabled by you and supported by your device or platform settings;

▪ to detect, prevent and investigate bots, fraud, abuse, Exploit abuse, unauthorized access, prohibited multi-account activity, cheating, refund or chargeback abuse, payment disputes, security incidents and violations of the Terms of Use;

▪ to enforce geographic, legal, security and eligibility restrictions;

▪ to comply with applicable law, lawful requests, legal process, tax, accounting, sanctions or regulatory obligations; and

▪ to establish, exercise or defend legal claims and protect the rights, safety and property of DUCK × MY × DUCK, our Users and others.

6. LEGAL BASES FOR PROCESSING

Where the GDPR or another law requires us to identify a legal basis, the legal basis depends on the particular processing activity. The principal bases on which we rely are described below.

▪ Account creation, authentication and core gameplay - Article 6(1)(b) GDPR (performance of a contract): we process Account identifiers, authentication data, character and game-progress data, technical data necessary to deliver the Services, and related information where processing is necessary to enter into or perform the Terms of Use and provide the Services or features you request.

▪ Detection of potentially matching existing Telegram-linked Accounts - Article 6(1)(f) GDPR (legitimate interests): where reasonably necessary, we compare limited account and authentication identifiers with existing Account records for our legitimate interests in facilitating continuity between the Telegram-based and mobile versions of the Services, reducing accidental creation of duplicate Accounts, protecting Account integrity and offering Users the Account-linking or synchronization choice described in the Terms of Use. A potential match does not by itself result in Account linking or transfer of progress, and a User may decline synchronization and use a separate mobile Account, subject to the functionality made available by the Services.

▪ Account linking and progress synchronization requested by the User - Article 6(1)(b) GDPR (performance of a contract): where you select the available linking or synchronization option, we process the Account, authentication, character, inventory, entitlement and progress information reasonably necessary to implement that selection and make the relevant Account available through supported linked access points.

▪ Telegram Stars and other supported purchases - Article 6(1)(b) GDPR (performance of a contract): we process transaction confirmations, transaction identifiers, entitlement information, transaction status and related information reasonably necessary to provide or administer a purchase requested by you. Where transaction records must be retained for tax, accounting or other mandatory legal requirements, Article 6(1)(c) GDPR (legal obligation) may also apply.

▪ Requested NFT and blockchain features - Article 6(1)(b) GDPR (performance of a contract): where you request an optional wallet connection, NFT minting, withdrawal, extraction or other supported NFT-related blockchain feature, we process the wallet and blockchain-related information reasonably necessary to provide that feature.

▪ Support and service communications - Article 6(1)(b) GDPR where processing is necessary to provide contractual support or service information, and Article 6(1)(f) GDPR where we have a legitimate interest in responding to inquiries, maintaining support continuity, managing our relationship with Users and protecting the integrity of support channels.

▪ Mobile publication and coordination with the Mobile Publisher - Article 6(1)(b) GDPR (performance of a contract) where processing or disclosure is reasonably necessary to provide the mobile Services, mobile purchases, entitlements or support requested by a User, and Article 6(1)(f) GDPR (legitimate interests) where reasonably necessary for our legitimate interests in operating mobile distribution, maintaining support continuity, administering Platform operations, preventing fraud and abuse, reconciling transactions, complying with Platform requirements and protecting our rights, provided that those interests are not overridden by your interests or fundamental rights and freedoms. Where the Mobile Publisher acts as a separate controller, it must identify and rely on an appropriate legal basis for its own processing under applicable law.

▪ Security, fraud prevention, anti-abuse and enforcement - Article 6(1)(f) GDPR (legitimate interests): we process technical, Account, gameplay, transaction, entitlement, verification and security information where reasonably necessary for our legitimate interests in protecting Users, accounts, systems and the in-game economy; preventing fraud, bots, cheating, Exploit abuse, prohibited multi-account activity, refund or chargeback abuse and unauthorized access; investigating security incidents and payment disputes; enforcing the Terms of Use; and establishing, exercising or defending legal claims, provided that those interests are not overridden by your interests or fundamental rights and freedoms. Where a specific security or compliance step is required by law, Article 6(1)(c) GDPR may apply instead.

▪ Service operation, diagnostics and improvement - Article 6(1)(f) GDPR (legitimate interests): we process technical, device, diagnostic, gameplay and performance information where reasonably necessary for our legitimate interests in maintaining reliability and compatibility, diagnosing faults, measuring service performance, improving gameplay and preventing technical misuse, provided those interests are not overridden by your rights and interests.

▪ Legal and regulatory compliance - Article 6(1)(c) GDPR (legal obligation): we process information where necessary to comply with applicable law, binding court or regulatory requests, tax and accounting requirements, sanctions rules, mandatory recordkeeping or other legal obligations to which DUCKY DUCK LTD is subject.

▪ Consent - Article 6(1)(a) GDPR: where a processing activity requires consent, including certain optional communications, device permissions or any future non-essential analytics, advertising or tracking technology that cannot lawfully rely on another basis, we will request consent separately. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

6.1. Provision of Personal Data and Consequences of Not Providing It

Certain personal data are necessary to create or authenticate an Account, provide core gameplay functionality, maintain game progress, provide a feature that you request, verify a purchase or entitlement, enable an optional wallet or blockchain-related feature, protect the security and integrity of the Services, or comply with applicable law. Where such information is necessary for the performance of our contract with you, failure to provide it may mean that we are unable to create or authenticate your Account or provide the relevant Service or feature. Where information is required to comply with a legal obligation, failure to provide it may prevent us from completing the relevant transaction or providing the affected feature where required by law. Other information and optional features are voluntary. Where reasonably possible, we will identify the consequences of declining optional processing at the point where the relevant choice is presented. If information reasonably necessary to identify or verify a potentially matching existing Telegram-linked Account is unavailable, we may be unable to offer Account linking or synchronization. Where the Services permit it, you may instead create and use a separate new mobile Account. Declining Account linking or synchronization does not, by itself, prevent you from using such a separate mobile Account, but the existing Telegram-linked progress, Items, In-Game Currency, resources and entitlements will not be transferred to that separate Account.

7. DISCLOSURE OF PERSONAL DATA

We do not sell or rent your personal data. We may disclose personal data only as reasonably necessary for the purposes described in this Privacy Policy, including to the following categories of recipients:

▪ hosting, infrastructure, security, anti-fraud, customer-support, development and other service providers that process data for us or help us operate the Services, subject to appropriate contractual and confidentiality obligations where required;

▪ the Mobile Publisher, Limited Liability Partnership "KowiyGames", and its authorized personnel or service providers, solely where reasonably necessary for mobile app distribution, store-account administration, first-line customer support, transaction and entitlement administration, analytics, fraud prevention, compliance or other mobile publishing activities described in this Privacy Policy; this disclosure does not extend the Mobile Publisher's role to the operation of the Telegram-based version or Telegram Stars transactions;

▪ Telegram, Apple, Google and other supported authentication or platform providers, where necessary to provide the authentication method selected by you or otherwise support Account authentication, security, linking or synchronization functionality made available through the Services;

▪ Telegram, where necessary in connection with Telegram authentication, Telegram Stars transactions, payment support or other Telegram-platform functionality;

▪ Google Play, the Apple App Store and supported payment providers, where necessary in connection with purchases or entitlements through the mobile application;

▪ wallet providers, blockchain networks and blockchain-related service providers, where necessary to provide a wallet connection, verify NFT ownership, or process an NFT minting, withdrawal, extraction or other supported blockchain action;

▪ participants, validators, nodes and users of a public blockchain network where you request a blockchain transaction and disclosure to that network is technically necessary to perform the requested NFT-related blockchain feature;

▪ other Users where a feature is designed to display your username, character, ranking, User Content or other gameplay information to other players, subject to the settings and rules of the relevant feature;

▪ competent courts, regulators, law-enforcement bodies, governmental authorities or other parties where disclosure is required or permitted by applicable law or reasonably necessary to protect rights, safety, property or the integrity of the Services;

▪ professional advisers such as lawyers, auditors and accountants where necessary for legitimate business, compliance or legal purposes; and

▪ a successor, purchaser or other relevant party in connection with a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable legal requirements.

Where a third party independently determines the purposes and means of its processing, that third party acts under its own privacy terms. This includes, as applicable, Telegram, Apple, Google, wallet providers and blockchain networks, as well as third-party marketplaces or similar services that a User independently chooses to use outside the Services.

Where the Mobile Publisher or another recipient processes personal data on our behalf as a processor or service provider, we require appropriate contractual, confidentiality, security and data-protection safeguards. We also require third parties that receive or access personal data in connection with the mobile application to provide protection appropriate to the nature of the data and consistent with applicable law and applicable Platform privacy requirements. Where the Mobile Publisher acts as a separate controller for a particular processing activity, it is responsible for complying with the obligations applicable to that processing under applicable data-protection law.

8. INTERNATIONAL TRANSFERS AND DATA LOCALIZATION

Because the Services may be accessible internationally and may rely on service providers, platforms and blockchain infrastructure located in different countries, personal data may be processed outside the country in which you are located. Public blockchain transactions may also be replicated or validated by nodes located in multiple jurisdictions. Where applicable law restricts international transfers, we will take the steps required by that law before making a transfer for which DUCK × MY × DUCK is responsible.

Where personal data subject to the GDPR are transferred outside the European Economic Area ("EEA") to a country or recipient covered by an adequacy decision of the European Commission, we may rely on that adequacy decision in accordance with Article 45 GDPR. Where no applicable adequacy decision exists, we will use an appropriate transfer mechanism permitted by Chapter V GDPR, which may include the European Commission's Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, together with supplementary technical, contractual or organizational measures where appropriate. You may contact us at [email protected] to request further information about the transfer mechanism applicable to your personal data and, where required by the GDPR, a copy of the relevant safeguards, subject to appropriate redactions necessary to protect confidential or commercially sensitive information.

The Mobile Publisher is established in Kazakhstan, and personal data relating to the mobile application may be accessed or processed in Kazakhstan to the extent reasonably necessary for the mobile publishing activities described in this Privacy Policy. Where personal data subject to the GDPR are transferred by DUCKY DUCK LTD to the Mobile Publisher in Kazakhstan and the transfer is subject to Chapter V GDPR without an applicable adequacy decision, DUCKY DUCK LTD and the Mobile Publisher have entered into the applicable module or modules of the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 for transfers to which those SCCs are legally available. The Parties assess the circumstances of relevant transfers and apply supplementary technical, contractual or organizational measures where appropriate. If a particular transfer falls outside the legal scope of those SCCs or another transfer mechanism is required by applicable law, we will implement another valid Chapter V transfer mechanism before making the transfer. You may contact [email protected] to request information about the safeguards applicable to transfers to the Mobile Publisher and, where required by the GDPR, a copy of the relevant safeguards, subject to appropriate redactions necessary to protect confidential or commercially sensitive information.

For personal data of citizens of the Russian Federation, we will comply with applicable Russian requirements concerning collection, localization, storage and cross-border transfer of personal data to the extent those requirements apply to our processing. Where Russian law requires specified operations involving personal data collected from Russian citizens to be performed using databases located in the Russian Federation, we will organize those operations accordingly before relying on any subsequent cross-border transfer permitted by law.

9. DATA RETENTION AND ACCOUNT DELETION

We retain personal data for no longer than is reasonably necessary for the purposes for which it was collected and in accordance with the principle of storage limitation. The applicable period depends on the category of data, the feature involved, whether an Account remains active, security and fraud-prevention needs, applicable limitation periods, and legal, tax, accounting or regulatory obligations. In particular:

▪ Account, character, inventory and game-progress data are generally retained while the Account is active and thereafter only for the period reasonably necessary to complete account closure, resolve disputes, enforce rights, address fraud or abuse, or satisfy applicable legal obligations, after which the data are deleted or anonymized where appropriate;

▪ records reasonably necessary to maintain or evidence Account linking, synchronization status and the User's Account-configuration selection may be retained for as long as the relevant Account configuration remains active and thereafter for the period reasonably necessary for security, fraud prevention, support, dispute resolution or legal compliance;

▪ technical, access, diagnostic, security and anti-fraud records, including records concerning suspected Exploit, refund or chargeback abuse where applicable, are retained for a period proportionate to the relevant operational, security, fraud-prevention or enforcement purpose and may be retained longer where necessary in connection with an identified incident, investigation, dispute or legal claim;

▪ customer-support records and communications are retained for the period necessary to resolve the relevant request and for a reasonable period thereafter where needed for support continuity, dispute resolution, security or legal claims;

▪ purchase and transaction records, including relevant Telegram Stars transaction, refund or reversal records and NFT-related blockchain transaction records where processed by us, together with tax and accounting records, are retained for the periods required by applicable tax, accounting, financial or other mandatory recordkeeping laws;

▪ video-verification and identity-confirmation materials are retained only for as long as reasonably necessary to complete the relevant verification or review and resolve any related security, fraud, compliance or dispute issue, unless a longer period is required by applicable law;

▪ records of consent, withdrawal of consent and privacy-rights requests may be retained for as long as reasonably necessary to demonstrate compliance and address applicable limitation periods; and

▪ residual copies in backups are removed or overwritten in accordance with our ordinary backup cycles, subject to any lawful preservation requirement. Data recorded on public blockchains are subject to the separate limitations described in Section 3.4 and may remain available independently of our systems.

If you request deletion of your DUCK × MY × DUCK account, we will delete or anonymize personal data associated with the account to the extent required by applicable law and the rules of the distribution platform, subject to information that we must or are permitted to retain for legal compliance, fraud prevention, security, dispute resolution, accounting, enforcement of rights or other lawful purposes. Account deletion does not erase data recorded on public blockchains that are not controlled by DUCK × MY × DUCK.

A request to delete or stop using your DUCK × MY × DUCK account does not automatically delete your separate Telegram, Google, Apple, wallet or other third-party account. You must manage those accounts directly with the relevant provider.

Where the mobile application supports creation of a game account, a clear mechanism for initiating account deletion may be made available in connection with the mobile application in accordance with applicable app-store requirements. Additional deletion instructions may be presented in the mobile application or on a web page linked from the relevant app-store listing. Alternatively, you may always send us an account deletion request via [email protected]. If your request concerns the exercise of a privacy right relating to erasure of personal data rather than only closure of the game account, you may also contact [email protected].

Where an existing Telegram-linked Account has been linked or synchronized with the mobile application and both access points use the same underlying DUCK × MY × DUCK Account, an Account-deletion request concerning that Account may affect access to that same Account through all linked access points.

Where a User declined synchronization and created a separate mobile Account, the existing Telegram-linked Account and the separate mobile Account remain distinct DUCK × MY × DUCK Accounts. A request to close or delete one such Account does not automatically close or delete the other unless the User requests deletion of both Accounts or applicable law requires otherwise. Where necessary, we may ask the User to identify which Account or Accounts the request concerns.

Where the Mobile Publisher processes personal data on behalf of DUCKY DUCK LTD, it is required to retain, return or delete that data in accordance with applicable contractual instructions and data-protection law. Where the Mobile Publisher acts as a separate controller for data maintained through its own developer, payment or Platform accounts, it may be required or permitted to retain limited records for its own legal, accounting, fraud-prevention, security or Platform-compliance purposes, subject to applicable law. You may submit account-deletion and privacy requests through [email protected] or [email protected] as described above, and we will coordinate with the Mobile Publisher where necessary.

10. INFORMATION SECURITY

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse or destruction. Depending on the systems involved, such measures may include access controls, restricted personnel access, secure communications, encryption in transit, logging, backups and security monitoring. No Internet transmission or storage system is completely secure, and we cannot guarantee absolute security.

Payment-card information is processed by the relevant payment, app-store or gateway provider rather than being stored by DUCK × MY × DUCK as full card details after a transaction. We expect service providers that process personal data on our behalf to apply appropriate security and confidentiality protections.

If a personal-data breach occurs, we will assess and make notifications to competent authorities and affected individuals where and within the time periods required by applicable law.

11. YOUR PRIVACY RIGHTS

Your rights depend on where you live and the law that applies to the relevant processing. We will not discriminate against you for exercising a privacy right where such discrimination is prohibited by law. We may need to verify your identity or account ownership before fulfilling a request, and authorized agents may be required to provide evidence of authority where permitted by law.

11.1. European Economic Area

Where the GDPR applies, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and data portability; to object to processing based on legitimate interests; to withdraw consent at any time where processing is based on consent; and, where Article 22 GDPR applies, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. You also have the right to lodge a complaint with a competent data-protection supervisory authority. These rights may be subject to conditions and exceptions under applicable law.

Where we rely on legitimate interests, you may object on grounds relating to your particular situation. Where personal data are processed for direct marketing, you may object to such processing at any time.

11.2. Russian Federation

Where Federal Law No. 152-FZ applies, you may have rights to obtain information concerning the processing of your personal data, require clarification, blocking or destruction of personal data that are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose, withdraw consent where processing is based on consent, and challenge unlawful processing before Roskomnadzor or a court, subject to applicable legal conditions and exceptions.

11.3. United States

If you are a resident of a U.S. state that grants consumer privacy rights and the relevant law applies to DUCK × MY × DUCK, you may have rights such as the right to know or access personal information, correct inaccuracies, request deletion, obtain a portable copy, opt out of certain sales, sharing, targeted advertising or profiling, limit certain uses of sensitive personal information, and appeal a refusal to act on a request. The precise rights and exceptions vary by state.

Based on the processing practices described in this Privacy Policy, DUCK × MY × DUCK does not sell personal data for monetary consideration. If our practices change in a way that creates an applicable right to opt out of sale, sharing or targeted advertising, we will update this Privacy Policy and provide the required choice mechanism before or when required by law.

12. CHILDREN AND MINORS

The Services are not intended for children under 13. Users aged 13 to 17 may use the Services only as permitted by the Terms of Use, applicable law and applicable platform requirements, including any requirement for a parent or legal guardian to review or accept the Terms on the User's behalf. We do not knowingly seek to collect personal data from children under 13. If we learn that we have collected such data contrary to applicable law, we will take reasonable steps to delete it or otherwise address the matter as required by law.

Where consent is the legal basis for processing in connection with the direct offer of an information-society service to a child, the applicable age of digital consent is determined by the law that applies to that User. Under Cyprus law, a child who is at least 14 years old may provide such consent on their own; below that age, consent must be given or authorized by the holder of parental responsibility where Cyprus law applies. The applicable age may differ in another EEA country. Where parental or guardian authorization is required, we will make reasonable and proportionate efforts, taking into account available technology, data-minimization principles and the risks of the processing, to verify that the required authorization has been provided. Parents or guardians may contact us at [email protected] regarding a minor's personal data, or may use the other privacy contact mechanisms described in this Privacy Policy. We may provide age-appropriate or layered privacy information where appropriate for younger Users.

13. DEVICE, PLATFORM AND APPLICATION TECHNOLOGIES

As described in Section 3.3, depending on the access point you use, the Services may process technical, device, application, network, diagnostic and security information generated by the mobile application, a Telegram bot or Mini App, a Telegram client, an embedded browser or WebView, the device operating system, the relevant platform or service components, or our application environment, where reasonably necessary to operate, secure, troubleshoot and deliver the Services. Depending on the feature used, this may include device or application identifiers, IP and connection data, operating-system and application versions, Telegram client or WebView information where applicable, language settings, push-notification tokens, crash reports, diagnostics and security metadata.

The Services may use platform APIs, technically necessary storage mechanisms or software-development-kit components that are necessary for functions such as authentication, Account matching, Account linking and synchronization, Telegram Mini App or bot operation, app-store operation, payments, NFT wallet connectivity, session management, security, crash diagnostics or push-notification delivery. We do not currently operate a standalone public website that uses browser cookies for analytics or advertising. The Telegram-based version may operate within a Telegram client, embedded browser or WebView and may use technically necessary storage or platform mechanisms for session, authentication or service functionality. Personal data processed through those components are subject to the categories, purposes, legal bases and disclosures described elsewhere in this Privacy Policy. If we introduce non-essential analytics, advertising, cross-service tracking technologies or third-party SDKs that collect additional personal or device data for purposes not already described here, we will assess the applicable disclosure and consent requirements, update this Privacy Policy and any applicable platform privacy disclosures, including Google Play Data safety and Apple App Privacy disclosures where relevant, and obtain consent or other permission before using such technology where required by applicable law.

14. THIRD-PARTY SERVICES AND LINKS

The Services may contain links to or integrate with third-party services, including Telegram, Google Play, the Apple App Store, wallet applications, blockchain networks and other websites or applications. Where a User independently chooses to use a third-party marketplace or similar service for an NFT after the NFT has been withdrawn from the Services, that service is separate from DUCK × MY × DUCK and is not operated by us. We are not responsible for the independent privacy practices of those third parties. You should review the privacy notices of the services you use. Their terms may apply in addition to this Privacy Policy and the DUCK × MY × DUCK Terms of Use.

15. AUTOMATED AND MANUAL SECURITY CHECKS

To protect fair gameplay, the in-game economy and the security of the Services, Account activity may be subject to automated and manual checks designed to identify suspected bots, fraud, abuse, prohibited multi-account activity, Exploit abuse, refund or chargeback abuse, cheating, security incidents or other violations of the Terms of Use. Automated tools may generate risk signals, flag activity for review or apply temporary technical safeguards while a review is pending. DUCK × MY × DUCK does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning a User or similarly significantly affect a User within the meaning of Article 22 GDPR. Material and continuing Account restrictions, permanent bans, definitive denial of an NFT withdrawal or extraction, or comparable significant adverse decisions are subject to meaningful human review before becoming final. Where applicable law grants a right to request human intervention, express a point of view or contest a decision, we will provide the corresponding safeguard. You may contact [email protected] or [email protected] if you believe a significant decision affecting your Account requires review.

16. COMMUNICATIONS AND PUSH NOTIFICATIONS

We may send service-related communications through Telegram, the mobile application, in-game notices or mobile push notifications. These may include transactional, security, account, legal or other important information relating to your use of the Services. Push notifications also depend on the permissions and settings of your mobile device and operating system. Where applicable law requires consent for promotional or other non-essential communications, we will request that consent and provide an available method to withdraw it.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to the Services, our processing practices, legal requirements or platform requirements. For material changes that meaningfully affect how we process personal data or the choices available to Users, we will provide an appropriate notice through the Services, the mobile application, Telegram, email where available, or another suitable channel before or when the change takes effect where required or appropriate under applicable law. We may require Users to acknowledge that the updated Privacy Policy has been made available before continuing to use the Services. Such acknowledgement is a notice/receipt mechanism and does not itself constitute consent to a processing activity unless we expressly request consent for that specific purpose. Non-material or clarifying changes may be communicated by updating the "Last amended" date. Where a new processing activity requires consent, we will request the required consent separately before relying on that consent-based processing.

18. CONTACT AND REQUESTS

For privacy questions, complaints, or requests to exercise a privacy right (including access, correction, erasure, restriction, portability, objection or withdrawal of consent where applicable), please contact [email protected]. We may request information reasonably necessary to understand the request, verify your identity or Account ownership and protect personal data against unauthorized disclosure or deletion. Where the GDPR applies, we will respond without undue delay and ordinarily within one month after receipt of a request. Where permitted by the GDPR, that period may be extended by up to two additional months where necessary because of the complexity or number of requests; in that case, we will inform you of the extension and the reasons for it within the initial one-month period. Requests are ordinarily handled free of charge, subject to the exceptions permitted by applicable law. If a request concerns personal data processed by or through the Mobile Publisher in connection with the mobile application, we may forward or coordinate the request with the Mobile Publisher as reasonably necessary to respond. You do not need to use a separate Mobile Publisher email address for this purpose.

If the GDPR applies, you have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus or, where applicable, with another competent supervisory authority in the EEA country of your habitual residence, place of work or the place of the alleged infringement. If another privacy law applies, you may also contact the supervisory or regulatory authority competent under that law.

For general customer support, technical or account-related questions, or assistance with account deletion, please contact [email protected].