1. INTRODUCTION

This privacy policy (hereinafter, the “Privacy Policy”) explains how Algoritcom Games SL, as the data controller, collects, uses, and protects your personal information when you use the Collectibol (hereinafter, the “Application”), as well as the website and associated services.

It also describes the rights you have regarding your personal data and how you can exercise them. This Privacy Policy has been drafted in accordance with current data protection legislation to clearly and transparently inform you about how we use your information.

By accessing or using our Application, you agree to the terms of this Privacy Policy. If you are a minor in your country or region, you confirm that your parent or legal guardian has read and accepted these terms on your behalf. If you or your legal representative do not agree with any of these terms, we kindly ask you not to use the Application.

2. ABOUT US

2.1 Algoritcom Games SL is a legally incorporated company in Spain. We are responsible for the processing of personal data collected through the Collectibol Application.

2.2 You can contact us through the following means:

Company: Algoritcom Games SL Address: Calle Muntaner 479, 6º4, 08021 Barcelona, Spain Tax ID (NIF): B70779715 Email: support@collectibol.com Email DPD: dpd@consulpyme.com

2.3 We may also contact you via email, SMS, or instant messaging apps such as WhatsApp to manage the delivery of rewards or prizes earned through the Application. These contacts will only be made when necessary to fulfill such purposes and in accordance with applicable legal bases.

2.4 If you have any questions or concerns related to this Privacy Policy or the processing of your personal data, you can contact us at the email address listed above.

3. INFORMATION WE COLLECT ABOUT YOU

3.1 Information you provide us You are not required to provide us with personal information to use the Application. However, if you choose not to, you may not be able to access certain features. We collect the information you provide in the following scenarios:

3.1.1 We collect the information you provide when you: (a) Access features or services that require personal data. (b) Link a social media account (e.g., Google, Facebook, Apple ID) to transfer data or authenticate access. (c) Contact us to make inquiries, provide feedback, or submit a complaint, whether via email, web forms, WhatsApp, or SMS. (We will always ask for your permission before doing so) ☐ I give my consent to receive commercial communications by electronic means (email, push notifications, etc.), in accordance with the Privacy Policy. (d) Participate in giveaways, promotions, or activities within the Application involving the delivery of prizes or rewards. In these cases, we may contact you via email, SMS, or WhatsApp. (We will always ask for your permission before doing so) ☐ I give my consent to receive commercial communications by electronic means (email, push notifications, etc.), in accordance with the Privacy Policy. (e) Send us mail or emails or use our customer support services.

3.1.2 The information you provide may include: (a) Third-party account identifiers. If you link a Google, Apple, or other provider account, we may receive your name, surname, email, and other identifiers, though we may not necessarily store this data. (b) Identity data: such as country or region and date of birth. (c) User profile data: such as username, user ID, language preferences, and other in-app configuration data. Note: Do not use personal information that can identify you (such as your real name or initials) as your username.

3.2 Information we collect automatically In addition to the information you provide, we also collect certain technical and usage information automatically when you interact with our Application. This may include:

3.2.1 Transaction data: Information about purchases or transactions made in the Application, such as the date, time, amount billed, and other relevant details.

3.2.3 Technical data: Device model, operating system, terminal configuration. Unique device identifiers (e.g., terminal ID or user ID). IP address, time zone settings, system language, connection status (e.g., HTTP status code). In-app behavior: visited pages, session count and duration, downloads, in-app purchases, actions, keystrokes, and game progress. Some of this data may be collected through cookies or third-party analytics tools. See the “Cookies” section for more information.

3.2.4 App permissions: We may request access to device features such as the camera or storage when needed for specific functionalities. Your prior consent will always be requested.

4. HOW WE USE YOUR INFORMATION AND WHO WE SHARE IT WITH

4.1 Legal basis for processing We will process your information based on: (a) The performance of a contract with you and the provision of our services. (b) Your consent, where applicable. (c) Compliance with legal or regulatory obligations. (d) Our legitimate interests.

4.2 Purposes of data processing We may use your information for legitimate commercial purposes, including: (a) To provide access to the Application and a personalized experience. (b) To grant access to in-app features such as purchases, card collections, rewards, tournaments, and other functionalities. (c) To allow interaction with other users and ensure a fair gaming experience. (d) To process transactions, payments, and related services. (e) To offer customer support and respond to inquiries or complaints. (f) To send push notifications (with prior consent) about app updates, features, rewards, news, or promotions. (g) To conduct analysis and statistics to improve the Application and services. (h) To contact you if you win a reward. (i) To comply with applicable policies, procedures, and legal obligations.

5. WHO WE MAY SHARE YOUR INFORMATION WITH

We may share your information with the following categories of third parties, only when necessary and in accordance with applicable laws:

(a) Other users within the Application (e.g., username, public stats) when participating in rankings or tournaments. (b) Developers and technical teams who maintain and improve the app. (c) Service providers offering analytics, hosting, support, or communication tools (email, SMS, WhatsApp). (d) Affiliated companies within the same corporate group, under the same data protection guarantees. (e) Buyers or investors during corporate transactions, mergers, or acquisitions. (f) Advertising networks, with limited information and only under your consent and privacy preferences. (g) Legal advisors and authorities when required to comply with the law or defend our rights.

6. USE OF THIRD-PARTY DATA COLLECTION MODULES

We may use third-party data collection modules to analyze usage trends of the Application, improve its functionality, prevent fraud, and display personalized advertising to users. The following entities may access certain information for these purposes. We also recommend reviewing their respective privacy policies:

RevenueCat, Inc.: for managing in-app purchases and subscriptions. Amplitude, Inc.: for analyzing the usage of the Application. Amazon Web Services (AWS): for server hosting and data storage.

7. HOW WE PROTECT YOUR INFORMATION AND HOW LONG WE KEEP IT

7.1 We implement appropriate technical, organizational, and operational security measures to protect your data against unauthorized access, loss, misuse, or disclosure.

7.2 We retain your data only as long as necessary to provide our services or comply with legal obligations, depending on: - The type of product or service used. - The nature and sensitivity of the data. - Our legitimate business needs. - Legal and regulatory requirements. - Recent activity or prolonged account inactivity. - User-controlled privacy tools. - The method of data storage.

7.3 When data is no longer needed, it is securely deleted or anonymized. Physical documents are shredded or incinerated; electronic data is erased using unrecoverable methods.

8. DATA PROTECTION AND SYSTEM SECURITY

Algoritcom Games S.L. is committed to maintaining the security, integrity, and stability of the Collectibol App at all times. To this end, we have implemented advanced technical and organizational measures aimed at ensuring data protection, proper system operation, and the prevention of unauthorized or fraudulent use by third parties or users.

8.1 To safeguard users’ personal data and ensure the security of the digital environment, Algoritcom Games S.L. has adopted, among others, the following measures: - Encryption of sensitive data both in transit and at rest. - Periodic internal and external security audits. - Automated systems to detect abnormal behavior. - Internal access controls with differentiated privilege levels. - Continuous updates and security patches for technical infrastructure.

8.2 In order to preserve the security and proper use of the Application, the following actions are strictly prohibited: - Reverse-engineering, decompiling, or attempting to alter the source code of the Application. - Introducing malware, bots, scripts, or third-party software that interfere with the functionality of Collectibol. - Obtaining cards, rewards, or other benefits through the exploitation of bugs, errors, or system vulnerabilities. - Impersonating other users, manipulating account identifiers, or performing unauthorized access.

8.3 Failure to comply with the conditions described in this section may result in, among others: - Immediate suspension or cancellation of the user account. - Loss of access to cards, rewards, and game progress. - Notification to competent authorities, including the Spanish Data Protection Agency (AEPD) or law enforcement, in cases of serious infractions, unauthorized access, or potential cybercrime.

9. INTERNATIONAL DATA TRANSFERS

9.1 Although Algoritcom Games S.L. is based in Spain, Collectibol is an international application available to users in multiple countries and regions. As such, your personal data may be stored, processed, or transferred to countries outside the European Economic Area (EEA) and the United Kingdom, including locations where we or our service providers operate.

9.2 If your data is transferred to countries that do not benefit from an adequacy decision by the European Commission or UK authorities, we will ensure that appropriate safeguards are in place in accordance with Articles 44–50 of the GDPR. These safeguards may include: - Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Addendum. - Transfers to entities located in countries with an adequate level of protection as recognized by the European Commission or the UK Parliament. - Transfers based on your explicit consent, or those necessary for the performance of a contract or pre-contractual measures.

9.3 We are committed to taking all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy. If you would like more information about the international transfer mechanisms we use, you may contact us as outlined in Section 2.

10. USER RIGHTS BASED ON GEOGRAPHICAL LOCATION

10.1 If you reside in the European Union (EU), United Kingdom, United States, or any country with specific data protection legislation, you may have certain rights over your personal information. These rights may vary depending on jurisdiction but typically include: - The right to be informed about how your data is collected and used. - The right to access your personal data. - The right to rectify inaccurate, incomplete, or outdated data. - The right to erasure (“right to be forgotten”), under certain conditions. - The right to restrict or object to data processing. - The right to data portability, where technically feasible. - The right to withdraw your consent at any time, if the processing is based on consent. - The right not to be subject to automated decisions without human involvement, where applicable.

10.2 To exercise any of these rights, you may email us at support@collectibol.com or contact us using the information provided in Section 2 of this Privacy Policy.

10.3 If you reside in the EU or another jurisdiction where it applies, you also have the right to file a complaint with a supervisory authority, such as the Spanish Data Protection Agency (AEPD), if you believe your data is being processed unlawfully.

10.4 Please note that even if you exercise your rights to object or delete your data, we may retain certain personal information where required by law, for record-keeping purposes, dispute resolution, or to defend legal claims.

11. THIRD-PARTY LINKS

Our Application may contain links to third-party websites, plugins, or applications. By clicking on those links or enabling those connections, third parties may collect or share personal data about you. We do not control these third-party websites and are not responsible for their privacy practices. We recommend that you read the privacy policy of every external site you visit once you leave our Application or website.

12. CHILDREN’S INFORMATION

12.1 In Spain, users under the age of 14 are not permitted to use the Application or submit personal data without the verifiable consent of a parent or legal guardian.

12.2 If you are between 14 and 17 years old, by using the Application you confirm that you have obtained parental or guardian authorization. We may request verifiable parental consent before allowing access to certain features.

13. CHANGES TO THE PRIVACY POLICY AND USER’S DUTY TO INFORM US OF CHANGES

We may update this Privacy Policy at any time by changing the “last updated” date. If we make significant changes to how we collect, use, or share your personal data, we will explain these changes and, where required by law, ask for your consent. It is important that the personal data we hold about you is accurate and up to date. Please inform us of any changes to your personal information during your relationship with us. You may do so by updating your profile information or contacting us using the details provided in Section 2.